diff --git a/mmv1/products/compute/HaVpnGateway.yaml b/mmv1/products/compute/HaVpnGateway.yaml
index 34e01079df17..137666c0c47a 100644
--- a/mmv1/products/compute/HaVpnGateway.yaml
+++ b/mmv1/products/compute/HaVpnGateway.yaml
@@ -41,6 +41,7 @@ async:
     resource_inside_response: false
 collection_url_key: 'items'
 custom_code:
+  post_create: 'templates/terraform/post_create/labels.tmpl'
 schema_version: 1
 state_upgraders: true
 examples:
@@ -169,3 +170,21 @@ properties:
           custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.tmpl'
           resource: 'InterconnectAttachment'
           imports: 'selfLink'
+  - name: 'labels'
+    type: KeyValueLabels
+    update_url: 'projects/{{project}}/regions/{{region}}/vpnGateways/{{name}}/setLabels'
+    update_verb: 'POST'
+    description: |
+      Labels for this resource. These can only be added or modified by the setLabels method.
+      Each label key/value pair must comply with RFC1035. Label values may be empty.
+  - name: 'labelFingerprint'
+    type: Fingerprint
+    update_url: 'projects/{{project}}/regions/{{region}}/vpnGateways/{{name}}/setLabels'
+    update_verb: 'POST'
+    description: |
+      A fingerprint for the labels being applied to this VpnGateway, which is essentially a hash
+      of the labels set used for optimistic locking. The fingerprint is initially generated by
+      Compute Engine and changes after every request to modify or update labels.
+      You must always provide an up-to-date fingerprint hash in order to update or change labels,
+      otherwise the request will fail with error 412 conditionNotMet.
+    output: true
diff --git a/mmv1/templates/terraform/examples/ha_vpn_gateway_basic.tf.tmpl b/mmv1/templates/terraform/examples/ha_vpn_gateway_basic.tf.tmpl
index a20645e5e9da..d67f82616176 100644
--- a/mmv1/templates/terraform/examples/ha_vpn_gateway_basic.tf.tmpl
+++ b/mmv1/templates/terraform/examples/ha_vpn_gateway_basic.tf.tmpl
@@ -2,6 +2,9 @@ resource "google_compute_ha_vpn_gateway" "ha_gateway1" {
   region   = "us-central1"
   name     = "{{index $.Vars "ha_vpn_gateway1_name"}}"
   network  = google_compute_network.network1.id
+  labels = {
+    mykey = "myvalue"
+  }
 }
 
 resource "google_compute_network" "network1" {
diff --git a/mmv1/templates/terraform/examples/ha_vpn_gateway_ipv6.tf.tmpl b/mmv1/templates/terraform/examples/ha_vpn_gateway_ipv6.tf.tmpl
index 7c5efe0534d6..62ae72ec7fda 100644
--- a/mmv1/templates/terraform/examples/ha_vpn_gateway_ipv6.tf.tmpl
+++ b/mmv1/templates/terraform/examples/ha_vpn_gateway_ipv6.tf.tmpl
@@ -3,6 +3,9 @@ resource "google_compute_ha_vpn_gateway" "ha_gateway1" {
   name     = "{{index $.Vars "ha_vpn_gateway1_name"}}"
   network  = google_compute_network.network1.id
   stack_type = "IPV4_IPV6"
+  labels = {
+    mykey = "myvalue"
+  }
 }
 
 resource "google_compute_network" "network1" {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_ha_vpn_gateway_test.go b/mmv1/third_party/terraform/services/compute/resource_compute_ha_vpn_gateway_test.go
new file mode 100644
index 000000000000..241fceb5669b
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_ha_vpn_gateway_test.go
@@ -0,0 +1,74 @@
+package compute_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccComputeHaVpnGateway_updateLabels(t *testing.T) {
+	t.Parallel()
+
+	rnd := acctest.RandString(t, 10)
+	resourceName := "google_compute_ha_vpn_gateway.ha_gateway1"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeHaVpnGateway_updateLabels(rnd, "test", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "labels.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "labels.test", "test"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeHaVpnGateway_updateLabels(rnd, "testupdated", "testupdated"),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction("google_compute_ha_vpn_gateway.ha_gateway1", plancheck.ResourceActionUpdate),
+					},
+				},
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "labels.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "labels.testupdated", "testupdated"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccComputeHaVpnGateway_updateLabels(suffix, key, value string) string {
+	return fmt.Sprintf(`
+resource "google_compute_ha_vpn_gateway" "ha_gateway1" {
+  region   = "us-central1"
+  name     = "tf-test-ha-vpn-1%s"
+  network  = google_compute_network.network1.id
+
+  labels = {
+    %s = "%s"
+  }
+}
+
+resource "google_compute_network" "network1" {
+  name                    = "network1%s"
+  auto_create_subnetworks = false
+}
+`, suffix, key, value, suffix)
+}