diff --git a/lib/plugins/tags.js b/lib/plugins/tags.js
new file mode 100644
index 000000000..7a28d8937
--- /dev/null
+++ b/lib/plugins/tags.js
@@ -0,0 +1,34 @@
+const Diffable = require('./diffable')
+
+module.exports = class Tags extends Diffable {
+  async find () {
+    return this.github.repos.listTagProtection(this.repo).then(res => res.data)
+  }
+
+  comparator (existing, attrs) {
+    return existing.pattern === attrs.pattern
+  }
+
+  changed (existing, attrs) {
+    return existing.pattern !== attrs.pattern
+  }
+
+  async update (existing, attrs) {
+    const { owner, repo } = this.repo
+
+    this.github.issues.deleteTagProtection(Object.assign({ tag_protection_id: existing.id }, attrs, { owner, repo }))
+    return this.github.repos.createTagProtection(Object.assign({ pattern: attrs.pattern }, attrs, { owner, repo }))
+  }
+
+  add (attrs) {
+    const { owner, repo } = this.repo
+    return this.github.repos.createTagProtection(Object.assign({ pattern: attrs.pattern }, attrs, { owner, repo }))
+  }
+
+  remove (existing) {
+    const { owner, repo } = this.repo
+    return this.github.repos.deleteTagProtection(
+      Object.assign({ tag_protection_id: existing.id }, existing, { owner, repo })
+    )
+  }
+}
diff --git a/lib/settings.js b/lib/settings.js
index cf2da95db..d175538c8 100644
--- a/lib/settings.js
+++ b/lib/settings.js
@@ -41,7 +41,8 @@ Settings.PLUGINS = {
   environments: require('./plugins/environments'),
   teams: require('./plugins/teams'),
   milestones: require('./plugins/milestones'),
-  branches: require('./plugins/branches')
+  branches: require('./plugins/branches'),
+  tags: require('./plugins/tags')
 }
 
 module.exports = Settings
diff --git a/test/fixtures/tags-config.yml b/test/fixtures/tags-config.yml
new file mode 100644
index 000000000..bfe2471f1
--- /dev/null
+++ b/test/fixtures/tags-config.yml
@@ -0,0 +1,3 @@
+tag_protection:
+  - pattern: "v1"
+  - pattern: "duplicate"
diff --git a/test/integration/plugins/tags.test.js b/test/integration/plugins/tags.test.js
new file mode 100644
index 000000000..2eac8fa57
--- /dev/null
+++ b/test/integration/plugins/tags.test.js
@@ -0,0 +1,39 @@
+const {
+  initializeNock,
+  loadInstance,
+  teardownNock,
+  repository,
+  buildTriggerEvent,
+  defineSettingsFileForScenario
+} = require('../common')
+const { OK, CREATED, NO_CONTENT } = require('http-status-codes')
+describe('tags plugin', function () {
+  let probot, githubScope
+
+  beforeEach(async () => {
+    githubScope = initializeNock()
+    probot = await loadInstance()
+  })
+
+  afterEach(() => {
+    teardownNock(githubScope)
+  })
+
+  it('configures tags', async () => {
+    await defineSettingsFileForScenario('tags-config.yml', githubScope)
+    githubScope.get(`/repos/${repository.owner.name}/${repository.name}/tags/protection`).reply(OK, [
+      { id: '1', pattern: '*' },
+      { id: '2', pattern: 'duplicate' }
+    ])
+
+    githubScope
+      .post(`/repos/${repository.owner.name}/${repository.name}/tags/protection`, body => {
+        expect(body).toMatchObject({ pattern: 'v1' })
+        return true
+      })
+      .reply(CREATED)
+    githubScope.delete(`/repos/${repository.owner.name}/${repository.name}/tags/protection/1`).reply(NO_CONTENT)
+
+    await probot.receive(buildTriggerEvent())
+  })
+})