diff --git a/krm-functions/toolbox/main.go b/krm-functions/toolbox/main.go
index 401dcd6b1..fb637caae 100644
--- a/krm-functions/toolbox/main.go
+++ b/krm-functions/toolbox/main.go
@@ -41,10 +41,13 @@ const (
 	ResourceVersionFilter = "RESOURCE_VERSION_FILTER"
 	// ResourceKindFilter used for filtering input bundle by document kind
 	ResourceKindFilter = "RESOURCE_KIND_FILTER"
-	scriptPath         = "script.sh"
-	scriptKey          = "script"
-	bundleFile         = "bundle.yaml"
-	workdir            = "/tmp"
+	// ResourceLabelFilter used for filtering input bundle by label selector
+	// example airshipit.org/ephemeral=true
+	ResourceLabelFilter = "RESOURCE_LABEL_FILTER"
+	scriptPath          = "script.sh"
+	scriptKey           = "script"
+	bundleFile          = "bundle.yaml"
+	workdir             = "/tmp"
 )
 
 func main() {
@@ -168,9 +171,11 @@ func (c *ScriptRunner) FilterBundle(items []*kyaml.RNode) ([]*kyaml.RNode, error
 	group := os.Getenv(ResourceGroupFilter)
 	version := os.Getenv(ResourceVersionFilter)
 	kind := os.Getenv(ResourceKindFilter)
+	labelSelector := os.Getenv(ResourceLabelFilter)
 	log.Printf("Filtering input bundle by Group: %s, Version: %s, Kind: %s",
 		group, version, kind)
 	return kyamlutils.DocumentSelector{}.
 		ByGVK(group, version, kind).
+		ByLabel(labelSelector).
 		Filter(items)
 }
diff --git a/krm-functions/toolbox/main_test.go b/krm-functions/toolbox/main_test.go
index d761c82d6..f3b25d59d 100644
--- a/krm-functions/toolbox/main_test.go
+++ b/krm-functions/toolbox/main_test.go
@@ -174,6 +174,8 @@ func TestFilterBundle(t *testing.T) {
 apiVersion: test/v1
 kind: Pod
 metadata:
+  labels:
+    app: nginx
   name: t1
 ---
 apiVersion: test/v1
@@ -195,6 +197,7 @@ metadata:
 		groupFilter   string
 		versionFilter string
 		kindFilter    string
+		labelFilter   string
 		errContains   string
 		expectedDocs  string
 	}{
@@ -208,6 +211,8 @@ metadata:
 			expectedDocs: `apiVersion: test/v1
 kind: Pod
 metadata:
+  labels:
+    app: nginx
   name: t1
 `,
 		},
@@ -234,6 +239,8 @@ metadata:
 			expectedDocs: `apiVersion: test/v1
 kind: Pod
 metadata:
+  labels:
+    app: nginx
   name: t1
 ---
 apiVersion: test/v1
@@ -245,6 +252,19 @@ apiVersion: test/v1beta1
 kind: Deployment
 metadata:
   name: t3
+`,
+		},
+		{
+			name:        "Filter by label only documents",
+			inputDocs:   docs,
+			labelFilter: "app=nginx",
+			errContains: "",
+			expectedDocs: `apiVersion: test/v1
+kind: Pod
+metadata:
+  labels:
+    app: nginx
+  name: t1
 `,
 		},
 	}
@@ -270,6 +290,8 @@ metadata:
 			defer os.Unsetenv(ResourceVersionFilter)
 			os.Setenv(ResourceKindFilter, tc.kindFilter)
 			defer os.Unsetenv(ResourceKindFilter)
+			os.Setenv(ResourceLabelFilter, tc.labelFilter)
+			defer os.Unsetenv(ResourceLabelFilter)
 
 			cmd := &ScriptRunner{
 				ScriptFile:         targetFile,