diff --git a/app/models/pxe_image.rb b/app/models/pxe_image.rb
index b9a6444e76f..93e64e5117e 100644
--- a/app/models/pxe_image.rb
+++ b/app/models/pxe_image.rb
@@ -5,6 +5,8 @@ class PxeImage < ApplicationRecord
 
   has_many :customization_templates, :through => :pxe_image_type
 
+  acts_as_miq_taggable
+
   before_validation do
     if self.default_for_windows_changed? && self.default_for_windows?
       pxe_server.pxe_images.where(:default_for_windows => true).update_all(:default_for_windows => false)
diff --git a/lib/rbac/filterer.rb b/lib/rbac/filterer.rb
index 97cad1480b6..dbf4d331454 100644
--- a/lib/rbac/filterer.rb
+++ b/lib/rbac/filterer.rb
@@ -50,6 +50,7 @@ class Filterer
       NetworkRouter
       OrchestrationStack
       OrchestrationTemplate
+      PxeImage
       ResourcePool
       SecurityGroup
       Service
diff --git a/spec/lib/rbac/filterer_spec.rb b/spec/lib/rbac/filterer_spec.rb
index 8445c6785e5..64a8e6a207f 100644
--- a/spec/lib/rbac/filterer_spec.rb
+++ b/spec/lib/rbac/filterer_spec.rb
@@ -212,6 +212,24 @@ def combine_filtered_ids(user_filtered_ids, belongsto_filtered_ids, managed_filt
         tagged_group.save!
       end
 
+      context 'searching for instances of PxeImage' do
+        let!(:pxe_image) { FactoryBot.create_list(:pxe_image, 2).first }
+
+        before do
+          pxe_image.tag_with('/managed/environment/prod', :ns => '*')
+        end
+
+        it 'lists only tagged PxeImages' do
+          results = described_class.search(:class => PxeImage, :user => user).first
+          expect(results).to match_array [pxe_image]
+        end
+
+        it 'lists only all PxeImages' do
+          results = described_class.search(:class => PxeImage, :user => admin_user).first
+          expect(results).to match_array PxeImage.all
+        end
+      end
+
       context 'searching for instances of Switches' do
         let!(:switch) { FactoryBot.create_list(:switch, 2).first }