diff --git a/app/models.py b/app/models.py
index 4a2690e9175402a8e0b3d5cc5c25bd58e4ab7c8d..89ed0720e2f2479e3683d7114108a4be17b1994f 100644
--- a/app/models.py
+++ b/app/models.py
@@ -527,7 +527,7 @@ interfacetags_table = db.Table(
 
 
 class Tag(QRCodeMixin, db.Model):
-    pass
+    admin_only = db.Column(db.Boolean, nullable=False, default=False)
 
 
 class Host(CreatedMixin, db.Model):
diff --git a/app/network/forms.py b/app/network/forms.py
index 145a8a927302d49b0948511dd84656b46b459f1b..2a228b08eefc8a20e6d4a845921e9a7b47c88316 100644
--- a/app/network/forms.py
+++ b/app/network/forms.py
@@ -121,11 +121,14 @@ class InterfaceForm(CSEntryForm):
         self.host_id.choices = utils.get_model_choices(models.Host)
         if current_user.is_admin:
             network_query = models.Network.query
+            tags_query = models.Tag.query
         else:
             network_query = models.Network.query.filter(models.Network.admin_only.is_(False))
+            tags_query = models.Tag.query.filter(models.Tag.admin_only.is_(False))
         self.network_id.choices = utils.get_model_choices(models.Network, allow_none=False,
                                                           attr='vlan_name', query=network_query)
-        self.tags.choices = utils.get_model_choices(models.Tag, allow_none=True, attr='name')
+        self.tags.choices = utils.get_model_choices(models.Tag, allow_none=True,
+                                                    attr='name', query=tags_query)
 
 
 class HostInterfaceForm(HostForm, InterfaceForm):