diff --git a/cli/packages/cmd/export.go b/cli/packages/cmd/export.go
index d0db485b3..26cc45f65 100644
--- a/cli/packages/cmd/export.go
+++ b/cli/packages/cmd/export.go
@@ -87,16 +87,12 @@ var exportCmd = &cobra.Command{
 
 		var output string
 		if shouldExpandSecrets {
-			substitutions := util.ExpandSecrets(secrets, infisicalToken, "")
-			output, err = formatEnvs(substitutions, format)
-			if err != nil {
-				util.HandleError(err)
-			}
-		} else {
-			output, err = formatEnvs(secrets, format)
-			if err != nil {
-				util.HandleError(err)
-			}
+			secrets = util.ExpandSecrets(secrets, infisicalToken, "")
+		}
+		secrets = util.FilterSecretsByTag(secrets, tagSlugs)
+		output, err = formatEnvs(secrets, format)
+		if err != nil {
+			util.HandleError(err)
 		}
 
 		fmt.Print(output)
diff --git a/cli/packages/util/secrets.go b/cli/packages/util/secrets.go
index a260aaaec..36cddbef8 100644
--- a/cli/packages/util/secrets.go
+++ b/cli/packages/util/secrets.go
@@ -220,6 +220,30 @@ func InjectImportedSecret(plainTextWorkspaceKey []byte, secrets []models.SingleE
 	return secrets, nil
 }
 
+func FilterSecretsByTag(plainTextSecrets []models.SingleEnvironmentVariable, tagSlugs string) []models.SingleEnvironmentVariable {
+	if tagSlugs == "" {
+		return plainTextSecrets
+	}
+
+	tagSlugsMap := make(map[string]bool)
+	tagSlugsList := strings.Split(tagSlugs, ",")
+	for _, slug := range tagSlugsList {
+		tagSlugsMap[slug] = true
+	}
+
+	filteredSecrets := []models.SingleEnvironmentVariable{}
+	for _, secret := range plainTextSecrets {
+		for _, tag := range secret.Tags {
+			if tagSlugsMap[tag.Slug] {
+				filteredSecrets = append(filteredSecrets, secret)
+				break
+			}
+		}
+	}
+
+	return filteredSecrets
+}
+
 func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectConfigFilePath string) ([]models.SingleEnvironmentVariable, error) {
 	var infisicalToken string
 	if params.InfisicalToken == "" {