diff --git a/lib/mrsk/commands/builder/base.rb b/lib/mrsk/commands/builder/base.rb
index 079b919a..4f2a8dbe 100644
--- a/lib/mrsk/commands/builder/base.rb
+++ b/lib/mrsk/commands/builder/base.rb
@@ -6,10 +6,18 @@ class Mrsk::Commands::Builder::Base < Mrsk::Commands::Base
   end
 
   def build_options
-    [ *build_tags, *build_args, *build_secrets ]
+    [ *build_tags, *build_labels, *build_args, *build_secrets ]
   end
 
   private
+    def build_tags
+      [ "-t", config.absolute_image, "-t", config.latest_image ]
+    end
+
+    def build_labels
+      argumentize "--label", { service: config.service }
+    end
+
     def build_args
       argumentize "--build-arg", args, redacted: true
     end
@@ -18,10 +26,6 @@ class Mrsk::Commands::Builder::Base < Mrsk::Commands::Base
       argumentize "--secret", secrets.collect { |secret| [ "id", secret ] }
     end
 
-    def build_tags
-      [ "-t", config.absolute_image, "-t", config.latest_image ]
-    end
-
     def args
       (config.builder && config.builder["args"]) || {}
     end
diff --git a/lib/mrsk/commands/prune.rb b/lib/mrsk/commands/prune.rb
index 974543c3..0a0902b2 100644
--- a/lib/mrsk/commands/prune.rb
+++ b/lib/mrsk/commands/prune.rb
@@ -6,7 +6,7 @@ class Mrsk::Commands::Prune < Mrsk::Commands::Base
   PRUNE_CONTAINERS_AFTER = 3.days.in_hours.to_i
 
   def images
-    docker :image, :prune, "--all", "--force", "--filter", "until=#{PRUNE_IMAGES_AFTER}h"
+    docker :image, :prune, "--all", "--force", "--filter", "label=service=#{config.service}", "--filter", "until=#{PRUNE_IMAGES_AFTER}h"
   end
 
   def containers
diff --git a/test/commands/builder_test.rb b/test/commands/builder_test.rb
index d88e30eb..4dfdcae2 100644
--- a/test/commands/builder_test.rb
+++ b/test/commands/builder_test.rb
@@ -8,50 +8,50 @@ class CommandsBuilderTest < ActiveSupport::TestCase
   test "target multiarch by default" do
     builder = new_builder_command
     assert_equal "multiarch", builder.name
-    assert_equal [:docker, :buildx, :build, "--push", "--platform", "linux/amd64,linux/arm64", "--builder", "mrsk-app-multiarch", "-t", "dhh/app:123", "-t", "dhh/app:latest", "."], builder.push
+    assert_equal [:docker, :buildx, :build, "--push", "--platform", "linux/amd64,linux/arm64", "--builder", "mrsk-app-multiarch", "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "."], builder.push
   end
 
   test "target native when multiarch is off" do
     builder = new_builder_command(builder: { "multiarch" => false })
     assert_equal "native", builder.name
-    assert_equal [:docker, :build, "-t", "dhh/app:123", "-t", "dhh/app:latest", ".", "&&", :docker, :push, "dhh/app:123"], builder.push
+    assert_equal [:docker, :build, "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", ".", "&&", :docker, :push, "dhh/app:123"], builder.push
   end
 
   test "target multiarch remote when local and remote is set" do
     builder = new_builder_command(builder: { "local" => { }, "remote" => { } })
     assert_equal "multiarch/remote", builder.name
-    assert_equal [:docker, :buildx, :build, "--push", "--platform", "linux/amd64,linux/arm64", "--builder", "mrsk-app-multiarch-remote", "-t", "dhh/app:123", "-t", "dhh/app:latest", "."], builder.push
+    assert_equal [:docker, :buildx, :build, "--push", "--platform", "linux/amd64,linux/arm64", "--builder", "mrsk-app-multiarch-remote", "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "."], builder.push
   end
 
   test "target native remote when only remote is set" do
     builder = new_builder_command(builder: { "remote" => { "arch" => "amd64" } })
     assert_equal "native/remote", builder.name
-    assert_equal [:docker, :buildx, :build, "--push", "--platform", "linux/amd64", "--builder", "mrsk-app-native-remote", "-t", "dhh/app:123", "-t", "dhh/app:latest", "."], builder.push
+    assert_equal [:docker, :buildx, :build, "--push", "--platform", "linux/amd64", "--builder", "mrsk-app-native-remote", "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "."], builder.push
   end
 
   test "build args" do
     builder = new_builder_command(builder: { "args" => { "a" => 1, "b" => 2 } })
-    assert_equal ["-t", "dhh/app:123", "-t", "dhh/app:latest", "--build-arg", "a=1", "--build-arg", "b=2"], builder.target.build_options
+    assert_equal ["-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "--build-arg", "a=1", "--build-arg", "b=2"], builder.target.build_options
   end
 
   test "build secrets" do
     builder = new_builder_command(builder: { "secrets" => ["token_a", "token_b"] })
-    assert_equal ["-t", "dhh/app:123", "-t", "dhh/app:latest", "--secret", "id=token_a", "--secret", "id=token_b"], builder.target.build_options
+    assert_equal ["-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "--secret", "id=token_a", "--secret", "id=token_b"], builder.target.build_options
   end
 
   test "native push with build args" do
     builder = new_builder_command(builder: { "multiarch" => false, "args" => { "a" => 1, "b" => 2 } })
-    assert_equal [ :docker, :build, "-t", "dhh/app:123", "-t", "dhh/app:latest", "--build-arg", "a=1", "--build-arg", "b=2", ".", "&&", :docker, :push, "dhh/app:123" ], builder.push
+    assert_equal [ :docker, :build, "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "--build-arg", "a=1", "--build-arg", "b=2", ".", "&&", :docker, :push, "dhh/app:123" ], builder.push
   end
 
   test "multiarch push with build args" do
     builder = new_builder_command(builder: { "args" => { "a" => 1, "b" => 2 } })
-    assert_equal [ :docker, :buildx, :build, "--push", "--platform", "linux/amd64,linux/arm64", "--builder", "mrsk-app-multiarch", "-t", "dhh/app:123", "-t", "dhh/app:latest", "--build-arg", "a=1", "--build-arg", "b=2", "." ], builder.push
+    assert_equal [ :docker, :buildx, :build, "--push", "--platform", "linux/amd64,linux/arm64", "--builder", "mrsk-app-multiarch", "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "--build-arg", "a=1", "--build-arg", "b=2", "." ], builder.push
   end
 
   test "native push with with build secrets" do
     builder = new_builder_command(builder: { "multiarch" => false, "secrets" => [ "a", "b" ] })
-    assert_equal [ :docker, :build, "-t", "dhh/app:123", "-t", "dhh/app:latest", "--secret", "id=a", "--secret", "id=b", ".", "&&", :docker, :push, "dhh/app:123" ], builder.push
+    assert_equal [ :docker, :build, "-t", "dhh/app:123", "-t", "dhh/app:latest", "--label", "service=app", "--secret", "id=a", "--secret", "id=b", ".", "&&", :docker, :push, "dhh/app:123" ], builder.push
   end
 
   private
diff --git a/test/commands/prune_test.rb b/test/commands/prune_test.rb
index cda5c75a..adbe2816 100644
--- a/test/commands/prune_test.rb
+++ b/test/commands/prune_test.rb
@@ -10,7 +10,7 @@ class CommandsPruneTest < ActiveSupport::TestCase
 
   test "images" do
     assert_equal \
-      "docker image prune --all --force --filter until=168h",
+      "docker image prune --all --force --filter label=service=app --filter until=168h",
       new_command.images.join(" ")
   end