diff --git a/lower-constraints.txt b/lower-constraints.txt
index e1dd85b0fa..2fc4e0d630 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -113,7 +113,7 @@ python-keystoneclient==3.8.0
 python-mimeparse==1.6.0
 python-neutronclient==6.7.0
 python-novaclient==9.1.0
-python-openstackclient==3.12.0
+python-openstackclient==3.16.0
 python-subunit==1.0.0
 pytz==2013.6
 PyMySQL==0.7.6
diff --git a/requirements.txt b/requirements.txt
index 82023589eb..4b4f297e08 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,7 +12,7 @@ six>=1.10.0 # MIT
 stevedore>=1.20.0 # Apache-2.0
 neutron-lib>=1.16.0 # Apache-2.0
 osc-lib>=1.8.0 # Apache-2.0
-python-openstackclient>=3.12.0 # Apache-2.0
+python-openstackclient>=3.16.0 # Apache-2.0
 oslo.concurrency>=3.26.0 # Apache-2.0
 oslo.context>=2.19.2 # Apache-2.0
 oslo.config>=5.2.0 # Apache-2.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 96fb502b17..37dac0b8e0 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -22,5 +22,5 @@ WebTest>=2.0.27 # MIT
 bandit>=1.1.0 # Apache-2.0
 tempest>=17.1.0 # Apache-2.0
 pylint==1.7.6 # GPLv2
-python-openstackclient>=3.12.0 # Apache-2.0
+python-openstackclient>=3.16.0 # Apache-2.0
 requests-mock>=1.2.0 # Apache-2.0
diff --git a/vmware_nsx/osc/v2/security_group.py b/vmware_nsx/osc/v2/security_group.py
index debcbfe68f..30c741646a 100644
--- a/vmware_nsx/osc/v2/security_group.py
+++ b/vmware_nsx/osc/v2/security_group.py
@@ -18,6 +18,7 @@
 from osc_lib import utils as osc_utils
 
 from openstackclient.identity import common as identity_common
+from openstackclient.network.v2 import _tag
 from openstackclient.network.v2 import security_group
 
 from vmware_nsx._i18n import _
@@ -100,6 +101,8 @@ class NsxCreateSecurityGroup(security_group.CreateSecurityGroup):
 
         # Create the security group and display the results.
         obj = client.create_security_group(**attrs)
+        # tags cannot be set when created, so tags need to be set later.
+        _tag.update_tags_for_set(client, obj, parsed_args)
         display_columns, property_columns = security_group._get_columns(obj)
         data = osc_utils.get_item_properties(
             obj,
@@ -139,6 +142,9 @@ class NsxSetSecurityGroup(security_group.SetSecurityGroup):
 
         client.update_security_group(obj, **attrs)
 
+        # tags is a subresource and it needs to be updated separately.
+        _tag.update_tags_for_set(client, obj, parsed_args)
+
     def update_parser_common(self, parser):
         parser = super(NsxSetSecurityGroup, self).update_parser_common(parser)