diff --git a/pkg/command/cluster/clusterupdate/cmd.go b/pkg/command/cluster/clusterupdate/cmd.go
index 2952c61f9e..43b21d41c4 100644
--- a/pkg/command/cluster/clusterupdate/cmd.go
+++ b/pkg/command/cluster/clusterupdate/cmd.go
@@ -22,6 +22,7 @@ type command struct {
 
 	cluster                string
 	name                   string
+	label                  flag.Label
 	host                   string
 	port                   int64
 	authToken              string
@@ -55,6 +56,7 @@ func (cmd *command) init() {
 	w := flag.Wrap(cmd.Flags())
 	w.Cluster(&cmd.cluster)
 	w.Unwrap().StringVarP(&cmd.name, "name", "n", "", "")
+	w.Unwrap().Var(&cmd.label, "label", "")
 	w.Unwrap().StringVar(&cmd.host, "host", "", "")
 	w.Unwrap().Int64Var(&cmd.port, "port", 10001, "")
 	w.Unwrap().StringVar(&cmd.authToken, "auth-token", "", "")
@@ -79,6 +81,10 @@ func (cmd *command) run() error {
 		cluster.Name = cmd.name
 		ok = true
 	}
+	if cmd.Flags().Changed("label") {
+		cluster.Labels = cmd.label.ApplyDiff(cluster.Labels)
+		ok = true
+	}
 	if cmd.Flags().Changed("host") {
 		cluster.Host = cmd.host
 		ok = true
diff --git a/pkg/command/cluster/clusterupdate/cmd_integration_api_test.go b/pkg/command/cluster/clusterupdate/cmd_integration_api_test.go
index 81266c0db2..93ac10e7c9 100644
--- a/pkg/command/cluster/clusterupdate/cmd_integration_api_test.go
+++ b/pkg/command/cluster/clusterupdate/cmd_integration_api_test.go
@@ -8,6 +8,7 @@ package clusterupdate
 import (
 	"bytes"
 	"context"
+	"maps"
 	"os/exec"
 	"testing"
 
@@ -26,19 +27,32 @@ func TestSctoolClusterUpdateIntegrationAPITest(t *testing.T) {
 	for _, tc := range []struct {
 		name            string
 		args            []string
+		initialCluster  *models.Cluster
 		expectedCluster *models.Cluster
 	}{
 		{
 			name: "update cluster, no-changes",
 			args: []string{"cluster", "update", "--auth-token", authToken},
+			initialCluster: &models.Cluster{
+				Labels: map[string]string{
+					"k1": "v1",
+				},
+				ForceTLSDisabled: true,
+			},
 			expectedCluster: &models.Cluster{
-				ForceTLSDisabled:       true,
-				ForceNonSslSessionPort: false,
+				Labels: map[string]string{
+					"k1": "v1",
+				},
+				ForceTLSDisabled: true,
 			},
 		},
 		{
 			name: "update cluster, force TLS enabled",
 			args: []string{"cluster", "update", "--force-non-ssl-session-port"},
+			initialCluster: &models.Cluster{
+				ForceTLSDisabled:       true,
+				ForceNonSslSessionPort: false,
+			},
 			expectedCluster: &models.Cluster{
 				ForceTLSDisabled:       true,
 				ForceNonSslSessionPort: true,
@@ -47,6 +61,10 @@ func TestSctoolClusterUpdateIntegrationAPITest(t *testing.T) {
 		{
 			name: "update cluster, force TLS disabled",
 			args: []string{"cluster", "update", "--force-tls-disabled=false"},
+			initialCluster: &models.Cluster{
+				ForceTLSDisabled:       true,
+				ForceNonSslSessionPort: false,
+			},
 			expectedCluster: &models.Cluster{
 				ForceTLSDisabled:       false,
 				ForceNonSslSessionPort: false,
@@ -55,11 +73,33 @@ func TestSctoolClusterUpdateIntegrationAPITest(t *testing.T) {
 		{
 			name: "update cluster, clean TLS flag",
 			args: []string{"cluster", "update", "--force-tls-disabled=false", "--force-non-ssl-session-port"},
+			initialCluster: &models.Cluster{
+				ForceTLSDisabled:       true,
+				ForceNonSslSessionPort: false,
+			},
 			expectedCluster: &models.Cluster{
 				ForceTLSDisabled:       false,
 				ForceNonSslSessionPort: true,
 			},
 		},
+		{
+			name: "update cluster, add labels",
+			args: []string{"cluster", "update", "--label", "k1-,k2=v22,k4=v4"},
+			initialCluster: &models.Cluster{
+				Labels: map[string]string{
+					"k1": "v1",
+					"k2": "v2",
+					"k3": "v3",
+				},
+			},
+			expectedCluster: &models.Cluster{
+				Labels: map[string]string{
+					"k2": "v22",
+					"k3": "v3",
+					"k4": "v4",
+				},
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			// given
@@ -67,13 +107,25 @@ func TestSctoolClusterUpdateIntegrationAPITest(t *testing.T) {
 			if err != nil {
 				t.Fatalf("Unable to create managerclient to consume managet HTTP API, err = {%v}", err)
 			}
-			clusterID, err := client.CreateCluster(context.Background(), &models.Cluster{
-				AuthToken:        authToken,
-				Host:             clusterIntroHost,
-				Password:         testPass,
-				Username:         testUsername,
-				ForceTLSDisabled: true,
-			})
+
+			fillCluster := func(c *models.Cluster) {
+				if c.AuthToken == "" {
+					c.AuthToken = authToken
+				}
+				if c.Host == "" {
+					c.Host = clusterIntroHost
+				}
+				if c.Username == "" {
+					c.Username = testUsername
+				}
+				if c.Password == "" {
+					c.Password = testPass
+				}
+			}
+			fillCluster(tc.initialCluster)
+			fillCluster(tc.expectedCluster)
+
+			clusterID, err := client.CreateCluster(context.Background(), tc.initialCluster)
 			if err != nil {
 				t.Fatalf("Unable to create cluster for further updates, err = {%v}", err)
 			}
@@ -90,7 +142,7 @@ func TestSctoolClusterUpdateIntegrationAPITest(t *testing.T) {
 			}
 
 			defer func() {
-				if err != client.DeleteCluster(context.Background(), clusterID) {
+				if err := client.DeleteCluster(context.Background(), clusterID); err != nil {
 					t.Logf("Failed to delete cluster, err = {%v}", err)
 				}
 			}()
@@ -112,6 +164,9 @@ func TestSctoolClusterUpdateIntegrationAPITest(t *testing.T) {
 				t.Fatalf("ForceNonSslPort mismatch {%v} != {%v}, output={%v}", c.ForceNonSslSessionPort,
 					tc.expectedCluster.ForceNonSslSessionPort, string(output))
 			}
+			if !maps.Equal(c.Labels, tc.expectedCluster.Labels) {
+				t.Fatalf("Labels mismatch {%v} != {%v}", c.Labels, tc.expectedCluster.Labels)
+			}
 		})
 	}