diff --git a/AGENTS.md b/AGENTS.md
index a3f429ba..a763936a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -95,9 +95,15 @@ configs to pytest format, runs native pytest, and returns rich in-memory results
 Validation classes live in `isvtest/src/isvtest/validations/` grouped by domain
 (`generic.py`, `cluster.py`, `instance.py`, `network.py`, `iam.py`, `security.py`,
 `host.py`, `k8s_*.py`, `slurm_*.py`, `bm_*.py`). Each subclass is auto-discovered.
-Filtering labels live on the YAML wiring (`labels: [...]` per check in the suite/
-provider configs), not on the class; the catalog, pytest marks, `isvctl docs`,
-and the orchestrator's include/exclude-label filtering all read them from there.
+Filtering labels live on the YAML wiring (`labels: [...]` per check), not on the
+class; the catalog, pytest marks, `isvctl docs`, and the orchestrator's
+include/exclude-label filtering all read them from there. Declare labels ONLY in
+`isvctl/configs/suites/*.yaml` - never add `labels:` to per-check wiring under
+`isvctl/configs/providers/**`; provider configs inherit labels from the suites
+they import (top-level `exclude.labels:` filtering blocks are fine). Sole
+exception: the single-node local providers
+`isvctl/configs/providers/{k3s,microk8s,minikube}.yaml`, which wire host-level
+checks that exist in no suite.
 
 Workloads (`isvtest/src/isvtest/workloads/`) are long-running tests (NIM, NCCL,
 stress) labelled `("workload", "slow", ...)` with manifests and helper scripts
diff --git a/isvctl/configs/providers/nico/config/control-plane.yaml b/isvctl/configs/providers/nico/config/control-plane.yaml
index 1d59425e..6ae15563 100644
--- a/isvctl/configs/providers/nico/config/control-plane.yaml
+++ b/isvctl/configs/providers/nico/config/control-plane.yaml
@@ -60,11 +60,9 @@ tests:
       checks:
         FieldExistsCheck:
           test_id: "N/A"
-          labels: ["control_plane"]
           fields: ["account_id", "tests"]
         FieldValueCheck:
           test_id: "CP03-01"
-          labels: ["control_plane"]
           field: "success"
           expected: true
 
diff --git a/isvctl/configs/providers/nico/config/iam.yaml b/isvctl/configs/providers/nico/config/iam.yaml
index f736d7e3..2738919c 100644
--- a/isvctl/configs/providers/nico/config/iam.yaml
+++ b/isvctl/configs/providers/nico/config/iam.yaml
@@ -59,11 +59,9 @@ tests:
       checks:
         FieldExistsCheck:
           test_id: "N/A"
-          labels: ["iam"]
           fields: ["account_id", "authenticated", "tests"]
         StepSuccessCheck:
           test_id: "N/A"
-          labels: ["iam"]
 
   exclude:
     labels: []
diff --git a/isvctl/configs/providers/nico/config/network.yaml b/isvctl/configs/providers/nico/config/network.yaml
index b1f2452f..f9764a3a 100644
--- a/isvctl/configs/providers/nico/config/network.yaml
+++ b/isvctl/configs/providers/nico/config/network.yaml
@@ -109,24 +109,20 @@ tests:
       checks:
         TenantListedCheck:
           test_id: "N/A"
-          labels: ["network"]
 
     vpc_info:
       step: get_vpc
       checks:
         TenantInfoCheck:
-          test_id: "SDN01-02"
-          labels: ["min_req", "network"]
+          test_id: "N/A"
 
     network_connectivity:
       step: network_connectivity
       checks:
         StepSuccessCheck:
           test_id: "N/A"
-          labels: ["network"]
         FieldValueCheck:
           test_id: "N/A"
-          labels: ["network"]
           field: "tests.network_assigned.passed"
           expected: true
 
@@ -135,10 +131,8 @@ tests:
       checks:
         StepSuccessCheck:
           test_id: "N/A"
-          labels: ["network"]
         FieldValueCheck:
           test_id: "N/A"
-          labels: ["network"]
           field: "tests.network_setup.passed"
           expected: true