diff --git a/ci-operator/step-registry/hypershift/gcp/control-plane-setup/hypershift-gcp-control-plane-setup-commands.sh b/ci-operator/step-registry/hypershift/gcp/control-plane-setup/hypershift-gcp-control-plane-setup-commands.sh
index 519dc72ebb13..4f606ef2cda3 100644
--- a/ci-operator/step-registry/hypershift/gcp/control-plane-setup/hypershift-gcp-control-plane-setup-commands.sh
+++ b/ci-operator/step-registry/hypershift/gcp/control-plane-setup/hypershift-gcp-control-plane-setup-commands.sh
@@ -21,7 +21,7 @@ SA_EMAIL="${SA_NAME}@${CP_PROJECT_ID}.iam.gserviceaccount.com"
 
 # Custom role name and permissions (from workload-identity.yaml)
 ROLE_NAME="hypershiftPSCOperator"
-ROLE_PERMISSIONS="compute.forwardingRules.list,compute.forwardingRules.use,compute.serviceAttachments.create,compute.serviceAttachments.delete,compute.serviceAttachments.get,compute.serviceAttachments.list,compute.subnetworks.list,compute.subnetworks.use,compute.regionOperations.get"
+ROLE_PERMISSIONS="compute.forwardingRules.list,compute.forwardingRules.setLabels,compute.forwardingRules.use,compute.serviceAttachments.create,compute.serviceAttachments.delete,compute.serviceAttachments.get,compute.serviceAttachments.list,compute.subnetworks.list,compute.subnetworks.use,compute.regionOperations.get"
 
 # Enable tracing for non-sensitive operations
 set -x
diff --git a/ci-operator/step-registry/hypershift/gcp/create/hypershift-gcp-create-chain.yaml b/ci-operator/step-registry/hypershift/gcp/create/hypershift-gcp-create-chain.yaml
index 9058c171699f..85d99e20e1a5 100644
--- a/ci-operator/step-registry/hypershift/gcp/create/hypershift-gcp-create-chain.yaml
+++ b/ci-operator/step-registry/hypershift/gcp/create/hypershift-gcp-create-chain.yaml
@@ -74,6 +74,7 @@ chain:
         --service-account-signing-key-path "${SA_SIGNING_KEY_PATH}" \
         --oidc-issuer-url "${OIDC_ISSUER_URL}" \
         --boot-image "${GCP_BOOT_IMAGE}" \
+        --resource-labels "hypershift-e2e-resource-labels=enabled" \
         --annotations "hypershift.openshift.io/pod-security-admission-label-override=baseline" \
         --disable-cluster-capabilities Console \
         --disable-cluster-capabilities Ingress \