diff --git a/src/applications/managing-app-configuration.md b/src/applications/managing-app-configuration.md
index ce90d8c1f..7964768dd 100644
--- a/src/applications/managing-app-configuration.md
+++ b/src/applications/managing-app-configuration.md
@@ -2,6 +2,7 @@
 
 A Deis application [stores config in environment variables][].
 
+
 ## Setting Environment Variables
 
 Use `deis config` to modify environment variables for a deployed application.
@@ -205,9 +206,30 @@ TCP Socket Probe: N/A
 Configured health checks also modify the default application deploy behavior. When starting a new
 Pod, Workflow will wait for the health check to pass before moving onto the next Pod.
 
-[Slugbuilder]: ../understanding-workflow/components.md#builder-builder-slugbuilder-and-dockerbuilder
+
+## Isolate the Application
+
+Workflow supports isolating applications onto a set of nodes using `deis tags`.
+
+!!! note
+    In order to use tags, you must first launch your cluster with the proper node labels. If you do
+    not, tag commands will fail. Learn more by reading ["Assigning Pods to Nodes"][pods-to-nodes].
+
+Once your nodes are configured with appropriate label selectors, use `deis tags:set` to restrict
+the application to those nodes:
+
+```
+$ deis tags:set environ=prod
+Applying tags...  done, v4
+
+environ  prod
+```
+
+
 [attached resources]: http://12factor.net/backing-services
-[stores config in environment variables]: http://12factor.net/config
+[kubernetes-probes]: http://kubernetes.io/docs/user-guide/pod-states/#container-probes
+[pods-to-nodes]: http://kubernetes.io/docs/user-guide/node-selection/
 [release]: ../reference-guide/terms.md#release
 [router]:  ../understanding-workflow/components.md#router
-[kubernetes-probes]: http://kubernetes.io/docs/user-guide/pod-states/#container-probes
+[Slugbuilder]: ../understanding-workflow/components.md#builder-builder-slugbuilder-and-dockerbuilder
+[stores config in environment variables]: http://12factor.net/config
diff --git a/src/managing-workflow/security-considerations.md b/src/managing-workflow/security-considerations.md
index f5d9ac87f..a73475702 100644
--- a/src/managing-workflow/security-considerations.md
+++ b/src/managing-workflow/security-considerations.md
@@ -22,6 +22,8 @@ with `region=us-east-1`, you can configure an application to be deployed to us-w
 by using `deis tags set region=us-west-1`. Workflow will pass this configuration
 along to Kubernetes, which will schedule your application in different regions.
 
+See [Isolate the Application][] for more information.
+
 # Running Workflow on Public Clouds
 
 If you are running on a public cloud without security group features, you will have to set up
@@ -65,3 +67,6 @@ Application level whitelisting can also be done using the Deis client. To add/re
     $ deis whitelist -a drafty-zaniness
     === drafty-zaniness Whitelisted Addresses
     10.0.1.0/24
+
+
+[Isolate the Application]: ../applications/managing-app-configuration.md#isolate-the-application