diff --git a/CHANGES.rst b/CHANGES.rst
index a8cfa264a8..674692a40f 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -4,6 +4,7 @@ Changelog
 2.7.0 (unreleased)
 ------------------
 
+- #2958 Add labels with colors, filtering, and bulk-manage modal for samples
 - #2953 Fix IClientAwareMixin interface mismatch breaking client access on DX content
 - #2955 Defer workflow transition lookup with a React content-menu component
 - #2954 Declare i18n:domain on duration widget templates
diff --git a/src/senaite/core/api/label.py b/src/senaite/core/api/label.py
index 17d4c32e4e..7fffd991e0 100644
--- a/src/senaite/core/api/label.py
+++ b/src/senaite/core/api/label.py
@@ -18,6 +18,8 @@
 # Copyright 2018-2025 by it's authors.
 # Some rights reserved, see README and LICENSE.
 
+import re
+
 from bika.lims import api
 from bika.lims import logger
 from bika.lims.api import create
@@ -31,15 +33,47 @@
 from Products.CMFPlone.utils import classImplements
 from senaite.core.catalog import LABEL_CATALOG
 from senaite.core.catalog import SETUP_CATALOG
+from senaite.core.config.labels import LABEL_STORAGE
 from senaite.core.interfaces import ICanHaveLabels
 from senaite.core.interfaces import IHaveLabels
 from senaite.core.interfaces import ILabel
 from zope.interface import alsoProvides
 from zope.interface import noLongerProvides
 
-LABEL_STORAGE = "senaite.core.labels"
 BEHAVIOR_ID = ICanHaveLabels.__identifier__
 
+# 6-digit hex color string `#rrggbb`. Used to validate the optional
+# `color` attribute of a Label and to filter user-supplied values
+# before they are inlined into `style=""` attributes anywhere chips
+# are rendered.
+HEX_COLOR_RE = re.compile(r"^#[0-9a-fA-F]{6}$")
+
+
+def is_safe_color(value):
+    """Return True if `value` is a 6-digit hex color (`#rrggbb`).
+
+    Empty / None values are treated as unsafe so callers can fall
+    back to the default chip styling.
+    """
+    if not value:
+        return False
+    return bool(HEX_COLOR_RE.match(value))
+
+
+def chip_style(color):
+    """Inline CSS for a colored label chip, or empty string.
+
+    Returned string contains `;` separators, so callers that embed
+    it via Chameleon `tal:attributes` must go through a view method
+    (semicolons collide with TAL's attribute separator) rather than
+    inlining the expression directly.
+    """
+    if not is_safe_color(color):
+        return u""
+    return (
+        u"background-color: {c}; border-color: {c}; color: #fff"
+    ).format(c=color)
+
 
 def get_storage(obj, default=None):
     """Get label storage for the given object
@@ -84,7 +118,11 @@ def get_label_by_name(name, inactive=True):
     :param name: Name of the label
     :returns: Label object or None
     """
-    found = query_labels(title=name)
+    # The setup catalog's `title` FieldIndex stores unicode keys
+    # (post #2901 rebuild). Form-submitted names arrive as utf-8
+    # byte strings, so coerce before querying or the index raises
+    # `UnicodeDecodeError` on ASCII comparison.
+    found = query_labels(title=api.safe_unicode(name))
     if len(found) == 0:
         return None
     elif len(found) > 1:
@@ -202,6 +240,28 @@ def add_obj_labels(obj, labels):
     return get_obj_labels(obj)
 
 
+def parse_label_csv(raw):
+    """Parse a comma-separated label string (or list of strings) into a
+    sorted unique list of unicode names. Whitespace is stripped,
+    empties dropped.
+
+    Accepts the two shapes that come over HTTP:
+    - a single string `"foo, bar"`
+    - a list of strings `["foo", "bar,baz"]` (repeated query params)
+
+    Values are coerced to unicode because the setup catalog's `title`
+    FieldIndex expects unicode keys; comparing utf-8 bytes against
+    unicode raises `UnicodeDecodeError` inside `PluginIndexes`.
+    """
+    if isinstance(raw, (list, tuple)):
+        values = []
+        for entry in raw:
+            values.extend(api.safe_unicode(entry or u"").split(u","))
+    else:
+        values = api.safe_unicode(raw or u"").split(u",")
+    return sorted({v.strip() for v in values if v and v.strip()})
+
+
 def del_obj_labels(obj, labels):
     """Remove labels from the object
 
@@ -219,6 +279,34 @@ def del_obj_labels(obj, labels):
     return get_obj_labels(obj)
 
 
+def get_label_colors(names=None):
+    """Return a `{label_name: color}` map for the given label names.
+
+    When `names` is None, returns the map for all active labels.
+    Colors are read from the brain `color` metadata column to avoid
+    waking the Label objects. Empty / missing colors are omitted.
+    """
+    query = {"portal_type": "Label"}
+    if names:
+        query["title"] = list(names)
+    brains = search(query, catalog=SETUP_CATALOG)
+    out = {}
+    for brain in brains:
+        # Prefer the `getColor` metadata column — populated by the
+        # 2.7 upgrade step `setup_sample_labels`. Falls back to
+        # waking the Label and reading the attribute directly for
+        # instances where the catalog rebuild has not yet run
+        # (e.g. between code deploy and `portal_setup` re-import).
+        color = getattr(brain, "getColor", None)
+        if not color:
+            obj = api.get_object(brain, default=None)
+            if obj is not None:
+                color = getattr(obj, "color", None)
+        if color:
+            out[api.safe_unicode(brain.Title)] = api.safe_unicode(color)
+    return out
+
+
 def search_objects_by_label(label, **kw):
     """Search for objects having one or more of the given labels
 
diff --git a/src/senaite/core/behaviors/label.py b/src/senaite/core/behaviors/label.py
index 359309e2d8..52e2a8d4d2 100644
--- a/src/senaite/core/behaviors/label.py
+++ b/src/senaite/core/behaviors/label.py
@@ -28,10 +28,11 @@
 from plone.dexterity.schema import SCHEMA_CACHE
 from plone.supermodel import model
 from plone.supermodel.directives import fieldset
-from Products.CMFCore import permissions
 from senaite.core.api import label as label_api
 from senaite.core.catalog import SETUP_CATALOG
 from senaite.core.interfaces import ICanHaveLabels
+from senaite.core.permissions import ManageLabels
+from senaite.core.permissions import ViewLabels
 from senaite.core.z3cform.widgets.queryselect import QuerySelectWidgetFactory
 from zope import schema
 from zope.component import adapter
@@ -86,6 +87,13 @@ class ILabelSchema(model.Schema):
         label=u"Labels",
         fields=["Labels"])
 
+    # Gate the inline Labels chooser on the edit form by the same
+    # permissions used for chip visibility (ViewLabels) and chip
+    # add/remove (ManageLabels). Client users without ViewLabels
+    # neither see the field nor receive the chooser in form data.
+    directives.read_permission(Labels=ViewLabels)
+    directives.write_permission(Labels=ManageLabels)
+
     directives.widget(
         "Labels",
         QuerySelectWidgetFactory,
@@ -131,11 +139,11 @@ class LabelSchema(object):
     def __init__(self, context):
         self.context = context
 
-    @security.protected(permissions.View)
+    @security.protected(ViewLabels)
     def getLabels(self):
         return label_api.get_obj_labels(self.context)
 
-    @security.protected(permissions.ModifyPortalContent)
+    @security.protected(ManageLabels)
     def setLabels(self, value):
         labels = label_api.to_labels(value)
         return label_api.set_obj_labels(self.context, labels)
diff --git a/src/senaite/core/browser/controlpanel/labels/view.py b/src/senaite/core/browser/controlpanel/labels/view.py
index 79eaca3a74..330faf38a7 100644
--- a/src/senaite/core/browser/controlpanel/labels/view.py
+++ b/src/senaite/core/browser/controlpanel/labels/view.py
@@ -19,10 +19,11 @@
 # Some rights reserved, see README and LICENSE.
 
 import collections
+from cgi import escape as html_escape
 
 from bika.lims import api
 from bika.lims import bikaMessageFactory as _
-from bika.lims.utils import get_link_for
+from senaite.core.api import label as label_api
 from senaite.core.browser.controlpanel.listing import ControlPanelListingView
 from senaite.core.catalog import SETUP_CATALOG
 
@@ -84,18 +85,27 @@ def __init__(self, context, request):
         ]
 
     def folderitem(self, obj, item, index):
-        """Service triggered each time an item is iterated in folderitems.
-        The use of this service prevents the extra-loops in child objects.
-        :obj: the instance of the class to be foldered
-        :item: dict containing the properties of the object to be used by
-            the template
-        :index: current index of the item
-        """
+        # Always wake the object: we need Title / URL / Description
+        # anyway, so the brain-metadata shortcut would not save a wake.
         obj = api.get_object(obj)
-
-        item["replace"]["Title"] = get_link_for(obj)
+        color = getattr(obj, "color", u"") or u""
+        if not label_api.is_safe_color(color):
+            color = u""
+
+        title = api.safe_unicode(api.get_title(obj))
+        url = api.safe_unicode(api.get_url(obj))
+        style = label_api.chip_style(color)
+        style_attr = u' style="{}"'.format(style) if style else u""
+
+        item["replace"]["Title"] = (
+            u'<a class="sample-label" href="{url}"{style}>'
+            u'<span class="sample-label-text">{title}</span></a>'
+        ).format(
+            url=html_escape(url, quote=True),
+            style=style_attr,
+            title=html_escape(title),
+        )
         item["Description"] = api.get_description(obj)
-
         return item
 
     def folderitems(self):
diff --git a/src/senaite/core/browser/label/api.py b/src/senaite/core/browser/label/api.py
new file mode 100644
index 0000000000..994abf1b91
--- /dev/null
+++ b/src/senaite/core/browser/label/api.py
@@ -0,0 +1,176 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+from bika.lims import api
+from bika.lims.api.security import check_permission
+from bika.lims.decorators import returns_json
+from Products.Five.browser import BrowserView
+from senaite.core.api import label as label_api
+from senaite.core.config.labels import SAMPLE_LABEL_REINDEX
+from senaite.core.permissions import ManageLabels
+from zope.interface import implementer
+from zope.publisher.interfaces import IPublishTraverse
+
+
+@implementer(IPublishTraverse)
+class LabelsAPI(BrowserView):
+    """JSON endpoint for label management.
+
+    Routes are dispatched via subpath traversal:
+
+    - `<context>/@@labels/add` — POST: add one or more labels to
+      the context object. Auto-creates the corresponding `Label`
+      in `setup.labels` when the name is new. Requires
+      `senaite.core: Manage Labels`.
+
+    - `<context>/@@labels/remove` — POST: remove one or more
+      labels from the context object. Requires
+      `senaite.core: Manage Labels`.
+
+    - `@@labels/available` — GET: returns `{name, color,
+      description}` for every active label so consumers (e.g. the
+      active-filter chips above the listing search box) can paint
+      chips in the matching color. Requires `senaite.core: View
+      Labels`.
+
+    The browser page is registered at the lowest of the two
+    permissions (`ViewLabels`); the write routes re-check
+    `ManageLabels` and return 403 when missing. This keeps the
+    JSON contract symmetric (every route returns a JSON body) and
+    avoids exposing two ZCML page registrations for what is
+    logically one endpoint.
+
+    Labels are accepted in either of the two request shapes that
+    HTTP can deliver: `label=foo&label=bar` (repeated key) or
+    `labels=foo,bar` (comma-separated). Both are parsed through
+    `senaite.core.api.label.parse_label_csv`.
+    """
+
+    def __init__(self, context, request):
+        super(LabelsAPI, self).__init__(context, request)
+        self.traverse_subpath = []
+
+    def publishTraverse(self, request, name):
+        self.traverse_subpath.append(name)
+        return self
+
+    def __call__(self):
+        if len(self.traverse_subpath) != 1:
+            return self._not_found()
+        route = self.traverse_subpath[0]
+        handler = getattr(self, "_route_{}".format(route), None)
+        if handler is None:
+            return self._not_found()
+        return handler()
+
+    # ------------------------------------------------------------------
+    # Routes
+    # ------------------------------------------------------------------
+
+    @returns_json
+    def _route_add(self):
+        if not check_permission(ManageLabels, self.context):
+            return self._forbidden()
+        labels = self._read_submitted_labels()
+        if not labels:
+            return self._empty_input()
+        for name in labels:
+            if label_api.get_label_by_name(name) is None:
+                label_api.create_label(name)
+        new_labels = label_api.add_obj_labels(self.context, labels)
+        self.context.reindexObject(idxs=SAMPLE_LABEL_REINDEX)
+        return {"success": True, "labels": list(new_labels)}
+
+    @returns_json
+    def _route_remove(self):
+        if not check_permission(ManageLabels, self.context):
+            return self._forbidden()
+        labels = self._read_submitted_labels()
+        if not labels:
+            return self._empty_input()
+        new_labels = label_api.del_obj_labels(self.context, labels)
+        self.context.reindexObject(idxs=SAMPLE_LABEL_REINDEX)
+        return {"success": True, "labels": list(new_labels)}
+
+    @returns_json
+    def _route_available(self):
+        brains = label_api.query_labels()
+        labels = []
+        for brain in brains:
+            # Prefer the `getColor` metadata column. Falls back to
+            # waking the Label and reading the live attribute when
+            # the catalog rebuild has not yet propagated the new
+            # column to existing brains (matches the fallback in
+            # `senaite.core.api.label.get_label_colors`).
+            color = getattr(brain, "getColor", u"") or u""
+            if not color:
+                obj = api.get_object(brain, default=None)
+                if obj is not None:
+                    color = getattr(obj, "color", u"") or u""
+            labels.append({
+                "name": api.safe_unicode(brain.Title),
+                "color": api.safe_unicode(color),
+                "description": api.safe_unicode(brain.Description or u""),
+            })
+        return {"labels": labels}
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    def _read_submitted_labels(self):
+        """Parse labels from the request form into a sorted unique list.
+
+        Accepts both `label=foo&label=bar` (repeated keys) and
+        `labels=foo,bar` (comma-separated) shapes; both go through
+        the same parser to return unicode names.
+        """
+        values = []
+        single = self.request.form.get("label")
+        if isinstance(single, (list, tuple)):
+            values.extend(single)
+        elif single:
+            values.append(single)
+        multi = self.request.form.get("labels")
+        if multi:
+            values.append(multi)
+        return label_api.parse_label_csv(values)
+
+    @returns_json
+    def _empty_input(self):
+        self.request.response.setStatus(400)
+        return {
+            "success": False,
+            "error": "No labels submitted",
+            "labels": list(label_api.get_obj_labels(self.context)),
+        }
+
+    @returns_json
+    def _forbidden(self):
+        self.request.response.setStatus(403)
+        return {"success": False, "error": "Forbidden"}
+
+    @returns_json
+    def _not_found(self):
+        self.request.response.setStatus(404)
+        return {
+            "success": False,
+            "error": "Unknown route. Use one of: add, remove, available",
+        }
diff --git a/src/senaite/core/browser/label/configure.zcml b/src/senaite/core/browser/label/configure.zcml
index d17efd387c..407f1b01f8 100644
--- a/src/senaite/core/browser/label/configure.zcml
+++ b/src/senaite/core/browser/label/configure.zcml
@@ -10,4 +10,39 @@
       permission="senaite.core.permissions.ManageBika"
       layer="senaite.core.interfaces.ISenaiteCore"/>
 
+  <!-- Render the Label's page heading as a colored chip by
+       overriding the default `@@title` view that Plone's
+       main_template invokes for the document <h1>. Replaces the
+       earlier viewlet-based CSS-injection approach. -->
+  <browser:page
+      for="senaite.core.interfaces.ILabel"
+      name="title"
+      class=".title.LabelTitleView"
+      permission="zope.Public"
+      layer="senaite.core.interfaces.ISenaiteCore"/>
+
+  <!-- Single JSON endpoint for label management. Subpath traversal
+       dispatches to:
+       - @@senaite_labels/add       (POST, requires ManageLabels)
+       - @@senaite_labels/remove    (POST, requires ManageLabels)
+       - @@senaite_labels/available (GET,  requires ViewLabels)
+
+       The ZCML page registration uses the lowest of the two
+       permissions; the write routes re-check `ManageLabels` and
+       return 403 when missing.
+
+       N.B. The name is intentionally namespaced to `senaite_labels`
+       rather than the bare `labels` so the for="*" registration
+       cannot intercept traversal to e.g.
+       ++plone++senaite.core.static/assets/icons/labels — a path
+       that `bootstrap.py::resource_exists` walks when resolving
+       Label FTI icons. -->
+  <browser:page
+      for="*"
+      name="senaite_labels"
+      class=".api.LabelsAPI"
+      permission="senaite.core.permissions.ViewLabels"
+      layer="senaite.core.interfaces.ISenaiteCore"
+      allowed_attributes="publishTraverse"/>
+
 </configure>
diff --git a/src/senaite/core/browser/label/labeled_objects.py b/src/senaite/core/browser/label/labeled_objects.py
index d2b7e915d2..4463df2175 100644
--- a/src/senaite/core/browser/label/labeled_objects.py
+++ b/src/senaite/core/browser/label/labeled_objects.py
@@ -23,6 +23,7 @@
 from bika.lims import api
 from bika.lims import bikaMessageFactory as _
 from bika.lims.utils import get_link_for
+from plone.memoize import view
 from senaite.core.i18n import translate as t
 from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
 from senaite.core.browser.listing.base import ListingView
@@ -77,13 +78,6 @@ def __init__(self, context, request):
         ]
 
     def folderitem(self, obj, item, index):
-        """Service triggered each time an item is iterated in folderitems.
-        The use of this service prevents the extra-loops in child objects.
-        :obj: the instance of the class to be foldered
-        :item: dict containing the properties of the object to be used by
-            the template
-        :index: current index of the item
-        """
         obj = api.get_object(obj)
         labels = label_api.get_obj_labels(obj)
         portal_type = api.get_portal_type(obj)
@@ -98,9 +92,15 @@ def folderitem(self, obj, item, index):
 
         return item
 
+    @view.memoize
+    def _label_colors(self):
+        return label_api.get_label_colors()
+
     def render_labels(self, labels):
+        colors = self._label_colors()
         template = ViewPageTemplateFile("templates/object_labels.pt")
-        return template(self, labels=labels)
+        return template(self, labels=labels, colors=colors,
+                        chip_style=label_api.chip_style)
 
     def folderitems(self):
         items = super(LabeledObjectsView, self).folderitems()
diff --git a/src/senaite/core/browser/label/templates/object_labels.pt b/src/senaite/core/browser/label/templates/object_labels.pt
index 40ef5e64c9..f724dc910e 100644
--- a/src/senaite/core/browser/label/templates/object_labels.pt
+++ b/src/senaite/core/browser/label/templates/object_labels.pt
@@ -1,13 +1,15 @@
-<div class="slot-header"
+<div class="sample-labels"
      i18n:domain="senaite.core"
-     tal:define="labels options/labels;">
-
-  <ul class="list-unstyled d-table-row">
-    <li tal:repeat="label labels" class="d-inline-block">
-      <div class="p-1 mb-1 mr-1 bg-light border rounded small">
-        <span tal:replace="python:label"/>
-      </div>
-    </li>
-  </ul>
-
+     tal:define="labels options/labels;
+                 colors options/colors;
+                 chip_style nocall:options/chip_style;">
+  <tal:chip repeat="label labels">
+    <span class="sample-label"
+          tal:define="style python:chip_style(colors.get(label))"
+          tal:attributes="data-label python:label;
+                          style python:style or None">
+      <span class="sample-label-text"
+            tal:content="python:label" />
+    </span>
+  </tal:chip>
 </div>
diff --git a/src/senaite/core/browser/label/title.py b/src/senaite/core/browser/label/title.py
new file mode 100644
index 0000000000..581f7c1cfb
--- /dev/null
+++ b/src/senaite/core/browser/label/title.py
@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+from cgi import escape as html_escape
+
+from Products.Five.browser import BrowserView
+from senaite.core.api import label as label_api
+
+
+class LabelTitleView(BrowserView):
+    """Override of `@@title` for Label content.
+
+    Plone's `main_template.pt` renders the page heading via
+    `<h1 tal:replace="structure context/@@title" />`. Overriding the
+    view for `ILabel` lets us emit the heading already styled as a
+    colored chip — same look as the row chips and the chip grid in
+    the manage-labels modal — without resorting to a CSS-injection
+    viewlet or a body-class selector.
+    """
+
+    def __call__(self):
+        title = self.context.title or u""
+        color = getattr(self.context, "color", u"") or u""
+        style = label_api.chip_style(color)
+        style_attr = u' style="{}"'.format(style) if style else u""
+        return (
+            u'<h1 class="documentFirstHeading">'
+            u'<span class="sample-label sample-label--lg"{style}>'
+            u'<span class="sample-label-text">{title}</span>'
+            u'</span>'
+            u'</h1>'
+        ).format(style=style_attr, title=html_escape(title))
diff --git a/src/senaite/core/browser/listing/base.py b/src/senaite/core/browser/listing/base.py
index fd9f3c3930..b38c878a5c 100644
--- a/src/senaite/core/browser/listing/base.py
+++ b/src/senaite/core/browser/listing/base.py
@@ -18,10 +18,41 @@
 # Copyright 2018-2025 by it's authors.
 # Some rights reserved, see README and LICENSE.
 
+from cgi import escape as html_escape
+from urlparse import parse_qs
+
+from bika.lims import api
 from bika.lims.api.security import check_permission
+from plone.memoize import view
 from Products.CMFCore.permissions import ModifyPortalContent
 from Products.CMFPlone.utils import safe_unicode
 from senaite.app.listing import ListingView as BaseListingView
+from senaite.core.api import label as label_api
+from senaite.core.permissions import ManageLabels
+from senaite.core.permissions import ViewLabels
+
+LABEL_INDEX = "labels"
+LABEL_COLUMN = "getLabels"
+PRIMARY_COLUMN_CANDIDATES = ("Title", "title", "Name", "name", "getId")
+
+
+def _read_labels(obj):
+    """Return labels for the given brain/object without unnecessary wake.
+
+    Prefers the `getLabels` brain metadata column when present;
+    otherwise falls back to waking the object and calling
+    `getLabels()`.
+    """
+    value = getattr(obj, LABEL_COLUMN, None)
+    if value is not None:
+        # brain metadata is the bare value; never a method here
+        return value or ()
+    live = api.get_object(obj, default=None)
+    if live is None:
+        return ()
+    if hasattr(live, "getLabels"):
+        return live.getLabels() or ()
+    return ()
 
 
 class ListingView(BaseListingView):
@@ -32,31 +63,225 @@ class ListingView(BaseListingView):
     object's edit form inside a Bootstrap modal showing only the edit
     form content (#content or #content-core).
 
-    Subclasses may set ``edit_icon_column`` to the column key that should
+    Subclasses may set `edit_icon_column` to the column key that should
     receive the icon. When not set, the first non-empty key among
-    ``("Title", "title", "getId")`` is used.
+    `("Title", "title", "getId")` is used.
 
-    Subclasses may set ``edit_view`` to control which view is opened:
-    - ``"edit"`` (default) — appends ``/edit`` to the object URL; the modal
+    Subclasses may set `edit_view` to control which view is opened:
+    - `"edit"` (default) — appends `/edit` to the object URL; the modal
       auto-closes when the form navigates away after save/cancel.
-    - ``""`` — opens the object's base URL (e.g. the SENAITE sample view
+    - `""` — opens the object's base URL (e.g. the SENAITE sample view
       with inline editing); the modal stays open until dismissed manually.
+
+    Label chips are rendered under the primary column automatically when
+    the listing's catalog carries a `labels` KeywordIndex and a
+    `getLabels` metadata column. Subclasses may override
+    `label_target_column` to pin chips to a specific column.
     """
 
     edit_icon_column = None
     edit_view = "edit"
 
+    # Column key that receives label chips. `None` resolves to the first
+    # non-empty key among `PRIMARY_COLUMN_CANDIDATES`.
+    label_target_column = None
+
     def folderitems(self):
         items = super(ListingView, self).folderitems()
         if not check_permission(ModifyPortalContent, self.context):
             return items
         return [self._add_iframe_edit_link(item) for item in items]
 
+    def before_render(self):
+        super(ListingView, self).before_render()
+        if self.labels_filterable():
+            labels = self.get_request_labels()
+            if labels:
+                self.contentFilter["labels"] = {
+                    "query": labels,
+                    "operator": "and",
+                }
+
+    def folderitem(self, obj, item, index):
+        item = super(ListingView, self).folderitem(obj, item, index)
+        if not item:
+            return item
+        if self.labels_visible():
+            self._attach_label_chips(obj, item)
+        return item
+
+    # ------------------------------------------------------------------
+    # Label support
+    # ------------------------------------------------------------------
+
+    @view.memoize
+    def labels_visible(self):
+        """Whether this listing renders label chips.
+
+        Gated by the `ViewLabels` permission so that client users do
+        not see internal lab labels on shared samples. Transposed
+        listings (e.g. worksheet manage view) are also skipped because
+        their `after` slot is not a sample identifier.
+        """
+        if getattr(self, "transposed_view", False):
+            return False
+        return self.can_view_labels()
+
+    @view.memoize
+    def can_view_labels(self):
+        return check_permission(ViewLabels, self.context)
+
+    @view.memoize
+    def labels_filterable(self):
+        """Whether chips link to the `?labels=` filter.
+
+        Requires the listing's catalog to carry a `labels` index
+        AND the current user to have `ViewLabels`.
+        """
+        if not self.can_view_labels():
+            return False
+        catalog_id = getattr(self, "catalog", None)
+        if not catalog_id:
+            return False
+        catalog = api.get_tool(catalog_id, default=None)
+        if catalog is None:
+            return False
+        return LABEL_INDEX in catalog.indexes()
+
+    @view.memoize
+    def can_manage_labels(self):
+        return check_permission(ManageLabels, self.context)
+
+    def get_request_labels(self):
+        """Parse the `labels` query string into a sorted unique list.
+
+        Reads `request.form` first (initial page render) and falls
+        back to parsing `QUERY_STRING` directly because the AJAX
+        subpath POST (`/view/folderitems`) carries the query in
+        `QUERY_STRING` but Zope's publisher does not populate
+        `request.form` for the subpath JSON request.
+        """
+        raw = self.request.form.get("labels")
+        if not raw:
+            qs = self.request.get("QUERY_STRING") or ""
+            raw = parse_qs(qs).get("labels", [])
+        return label_api.parse_label_csv(raw)
+
+    def get_label_target_column(self, item):
+        if self.label_target_column:
+            return self.label_target_column
+        for key in PRIMARY_COLUMN_CANDIDATES:
+            if key in self.columns:
+                return key
+        return None
+
+    def render_label_chips(self, obj):
+        """Render the inline chip block for the given brain/object.
+
+        Every interpolated value is HTML-escaped before being
+        concatenated. Label titles are free-text content on the Label
+        type and the brain `color` value is admin-supplied, so both
+        must be treated as untrusted in this context — color values
+        pass through `is_safe_color` before any inline style is built.
+
+        Chips render as plain `<span>` when the listing's catalog
+        does not support label filtering (no `labels` index); as
+        clickable filter chips (`is-filterable` class, navigation
+        wired client-side) otherwise. Label removal is done through
+        the manage-labels modal, so the chip body carries no `×`.
+        """
+        labels = _read_labels(obj)
+        if not labels:
+            return u""
+
+        filterable = self.labels_filterable()
+        active = set(self.get_request_labels()) if filterable else set()
+        uid_attr = self._chip_uid_attr(obj)
+        colors = self._get_label_colors_map()
+
+        chips = [
+            self._render_chip(label, colors.get(safe_unicode(label)),
+                              active, filterable)
+            for label in labels
+        ]
+        return (
+            u'<div class="sample-labels" data-uid="{uid}">{chips}</div>'
+        ).format(uid=uid_attr, chips=u"".join(chips))
+
+    def _chip_uid_attr(self, obj):
+        uid = getattr(obj, "UID", None)
+        if callable(uid):
+            uid = uid()
+        return html_escape(safe_unicode(uid or u""), quote=True)
+
+    def _render_chip(self, label, color, active_set, filterable):
+        label_u = safe_unicode(label)
+        label_attr = html_escape(label_u, quote=True)
+        label_text = html_escape(label_u)
+        css_classes = [u"sample-label"]
+        if label in active_set:
+            css_classes.append(u"active")
+        if filterable:
+            css_classes.append(u"is-filterable")
+        style = label_api.chip_style(color)
+        style_attr = u' style="{}"'.format(style) if style else u""
+        return (
+            u'<span class="{cls}" data-label="{label_attr}"{style}>'
+            u'<span class="sample-label-text">{label_text}</span>'
+            u'</span>'
+        ).format(
+            cls=u" ".join(css_classes),
+            label_attr=label_attr,
+            label_text=label_text,
+            style=style_attr,
+        )
+
+    @view.memoize
+    def _get_label_colors_map(self):
+        """Per-render cache of `{label_name: color}` from the setup catalog.
+        """
+        return label_api.get_label_colors()
+
+    def _attach_label_chips(self, obj, item):
+        """Stack chips under the primary column value.
+
+        Going through `replace` avoids the `<span class="after-item">`
+        wrapper used by the `after` slot, which forces inline flow
+        and prevents chips from breaking to a new line.
+
+        Pre-existing `replace[target]` content (e.g. a `<a href=…>`
+        link the consumer view installed) is trusted as HTML. When
+        there is no such entry, the raw cell value comes from the
+        catalog metadata column and is escaped before being inlined,
+        so a sample id containing `<` cannot inject markup.
+        """
+        target = self.get_label_target_column(item)
+        if not target:
+            return
+        chips = self.render_label_chips(obj)
+        if not chips:
+            return
+        replace_map = item.setdefault("replace", {})
+        existing_html = replace_map.get(target)
+        if existing_html is None:
+            raw_value = safe_unicode(item.get(target, u"") or u"")
+            existing_html = html_escape(raw_value)
+        replace_map[target] = (
+            u'<div class="sample-id-with-labels">'
+            u'<div class="sample-id-with-labels__value">{value}</div>'
+            u'{chips}'
+            u'</div>'
+        ).format(value=safe_unicode(existing_html), chips=chips)
+
+    # ------------------------------------------------------------------
+    # Edit icon
+    # ------------------------------------------------------------------
+
     def _get_edit_icon_column(self, item):
         """Return the column key to attach the edit icon to."""
         if self.edit_icon_column:
             return self.edit_icon_column
-        for key in ("Title", "title", "getId"):
+        for key in PRIMARY_COLUMN_CANDIDATES:
             if item.get(key):
                 return key
         return None
diff --git a/src/senaite/core/browser/modals/configure.zcml b/src/senaite/core/browser/modals/configure.zcml
index fb265cdb9f..14704f9956 100644
--- a/src/senaite/core/browser/modals/configure.zcml
+++ b/src/senaite/core/browser/modals/configure.zcml
@@ -41,4 +41,12 @@
       layer="senaite.core.interfaces.ISenaiteCore"
       />
 
+  <browser:page
+      name="manage_labels_modal"
+      for="*"
+      class=".manage_labels.ManageLabelsModal"
+      permission="senaite.core.permissions.ManageLabels"
+      layer="senaite.core.interfaces.ISenaiteCore"
+      />
+
 </configure>
diff --git a/src/senaite/core/browser/modals/manage_labels.py b/src/senaite/core/browser/modals/manage_labels.py
new file mode 100644
index 0000000000..86d7de5703
--- /dev/null
+++ b/src/senaite/core/browser/modals/manage_labels.py
@@ -0,0 +1,203 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+from bika.lims import api
+from bika.lims import senaiteMessageFactory as _
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from senaite.core.api import label as label_api
+from senaite.core.browser.modals import Modal
+from senaite.core.config.labels import DEFAULT_LABEL_COLOR
+from senaite.core.config.labels import LABEL_COLOR_PRESETS
+from senaite.core.config.labels import SAMPLE_LABEL_REINDEX
+
+
+def _normalize_color(value):
+    if not value:
+        return u""
+    value = api.safe_unicode(value).strip()
+    if label_api.is_safe_color(value):
+        return value
+    return u""
+
+
+class ManageLabelsModal(Modal):
+    """Modal that adds labels to the selected samples.
+
+    Existing labels can be picked from a clickable chip grid; new
+    labels can be entered as free text with a color (preset / native
+    picker / random). New labels are created in `setup.labels` via
+    `senaite.core.api.label.create_label` before assignment.
+    """
+    template = ViewPageTemplateFile("templates/manage_labels.pt")
+
+    def __call__(self):
+        if self.request.form.get("submitted", False):
+            return self.handle_submit()
+        return self.template()
+
+    def add_status_message(self, message, level="info"):
+        return self.context.plone_utils.addPortalMessage(message, level)
+
+    def default_new_label_color(self):
+        """Seed value for the new-label color picker."""
+        return DEFAULT_LABEL_COLOR
+
+    def get_color_presets(self):
+        """Returns `[{name, color}, ...]` for the preset palette."""
+        return [{"name": name, "color": color}
+                for name, color in LABEL_COLOR_PRESETS]
+
+    def chip_style(self, color):
+        """Return a CSS `style` value for a colored chip.
+
+        Built here (not inline in the template) because the CSS
+        semicolons would collide with Chameleon's `tal:attributes`
+        separator. Returns an empty string for invalid / missing
+        colors so chips fall back to the default pill styling.
+        """
+        return label_api.chip_style(color)
+
+    def swatch_style(self, color):
+        if not label_api.is_safe_color(color):
+            return u""
+        return u"background-color: {c}".format(c=color)
+
+    def get_available_labels(self):
+        """Returns `[{name, color}, ...]` for all active labels.
+        """
+        brains = label_api.query_labels()
+        colors = label_api.get_label_colors() or {}
+        out = []
+        for brain in brains:
+            title = api.safe_unicode(brain.Title)
+            out.append({
+                "name": title,
+                "color": colors.get(title, u""),
+            })
+        return out
+
+    def get_selected_objects(self):
+        return [api.get_object(uid) for uid in self.uids]
+
+    def get_shared_labels(self):
+        objects = self.get_selected_objects()
+        if not objects:
+            return []
+        shared = set(label_api.get_obj_labels(objects[0]))
+        for obj in objects[1:]:
+            shared &= set(label_api.get_obj_labels(obj))
+        return sorted(shared)
+
+    def get_union_labels(self):
+        """Labels currently set on at least one of the selected objects.
+
+        Toggling these in the chip grid lets the user remove them; any
+        chip that the user leaves un-selected is interpreted as
+        "should not be on the samples after submit".
+        """
+        union = set()
+        for obj in self.get_selected_objects():
+            union.update(label_api.get_obj_labels(obj))
+        return sorted(union)
+
+    def _parse_selected_labels(self):
+        raw = self.request.form.get("selected_labels", "")
+        return label_api.parse_label_csv(raw)
+
+    def _parse_initial_labels(self):
+        raw = self.request.form.get("initial_labels", "")
+        return label_api.parse_label_csv(raw)
+
+    def _parse_new_label(self):
+        raw = self.request.form.get("new_label", u"") or u""
+        # Coerce to unicode so downstream `get_label_by_name` /
+        # `create_label` queries hit the setup catalog's unicode
+        # title index without a `UnicodeDecodeError`.
+        name = api.safe_unicode(raw).strip()
+        color = _normalize_color(self.request.form.get("new_label_color"))
+        return name, color
+
+    def handle_submit(self):
+        selected = set(self._parse_selected_labels())
+        initial = set(self._parse_initial_labels())
+        new_name, new_color = self._parse_new_label()
+
+        # Build the final desired set: selected ones the user kept,
+        # plus the new free-text label if any.
+        if new_name:
+            existing = label_api.get_label_by_name(new_name)
+            if existing is None:
+                kwargs = {}
+                if new_color:
+                    kwargs["color"] = new_color
+                label_api.create_label(new_name, **kwargs)
+            elif new_color:
+                if getattr(existing, "color", None) != new_color:
+                    existing.color = new_color
+                    existing.reindexObject()
+            selected.add(new_name)
+
+        # Diff against the initial state to derive add/remove sets.
+        to_add = sorted(selected - initial)
+        to_remove = sorted(initial - selected)
+
+        if not self.uids or (not to_add and not to_remove):
+            return self.template()
+
+        affected = 0
+        for obj in self.get_selected_objects():
+            if to_remove:
+                label_api.del_obj_labels(obj, to_remove)
+            if to_add:
+                label_api.add_obj_labels(obj, to_add)
+            obj.reindexObject(idxs=SAMPLE_LABEL_REINDEX)
+            affected += 1
+
+        if to_add and to_remove:
+            message = _(
+                u"labels_changed",
+                default=u"Applied ${added} added and ${removed} "
+                        u"removed across ${affected} sample(s)",
+                mapping={
+                    "added": len(to_add),
+                    "removed": len(to_remove),
+                    "affected": affected,
+                },
+            )
+        elif to_add:
+            message = _(
+                u"labels_added",
+                default=u"Added ${count} label(s) to ${affected} sample(s)",
+                mapping={
+                    "count": len(to_add),
+                    "affected": affected,
+                },
+            )
+        else:
+            message = _(
+                u"labels_removed",
+                default=u"Removed ${count} label(s) from ${affected} sample(s)",
+                mapping={
+                    "count": len(to_remove),
+                    "affected": affected,
+                },
+            )
+        self.add_status_message(message)
+        return self.template()
diff --git a/src/senaite/core/browser/modals/templates/manage_labels.pt b/src/senaite/core/browser/modals/templates/manage_labels.pt
new file mode 100644
index 0000000000..734a47177b
--- /dev/null
+++ b/src/senaite/core/browser/modals/templates/manage_labels.pt
@@ -0,0 +1,117 @@
+<div class="manage-labels-modal modal-dialog modal-dialog-centered">
+  <div class="modal-content">
+    <div class="modal-header">
+      <h5 class="modal-title" i18n:translate="">Manage labels</h5>
+      <button type="button" class="close" data-dismiss="modal"
+              aria-label="Close">
+        <span aria-hidden="true">&times;</span>
+      </button>
+    </div>
+    <div class="modal-body">
+      <form name="manage-labels-form"
+            class="form manage-labels-form"
+            method="POST"
+            enctype="multipart/form-data"
+            tal:attributes="action string:${here/absolute_url}/manage_labels_modal">
+
+        <!-- Existing labels — clickable chip grid.
+
+             Labels currently set on at least one of the selected
+             samples come pre-selected. Click toggles selection;
+             un-toggling a pre-selected chip removes that label on
+             submit. -->
+        <div class="form-group form-group-sm mb-3"
+             tal:define="
+               labels view/get_available_labels;
+               initial view/get_union_labels">
+          <label class="mr-2 small text-muted"
+                 i18n:translate="">
+            Choose existing labels (click to toggle, applied labels
+            are pre-selected; un-toggle to remove)
+          </label>
+          <div class="sample-labels manage-labels-grid"
+               tal:condition="labels">
+            <tal:chips repeat="label labels">
+              <button type="button"
+                      class="sample-label manage-labels-toggle"
+                      tal:define="
+                        name python:label['name'];
+                        color python:label['color'];
+                        is_initial python:name in initial;
+                        style python:view.chip_style(color)"
+                      tal:attributes="
+                        data-label python:name;
+                        data-selected python:'1' if is_initial else '0';
+                        style python:style or None"
+                      tal:content="python:name" />
+            </tal:chips>
+          </div>
+          <p class="small text-muted mt-1"
+             tal:condition="not:labels"
+             i18n:translate="">
+            No labels yet. Type a new one below.
+          </p>
+        </div>
+
+        <!-- New label — free text + color -->
+        <div class="form-group form-group-sm mb-3 manage-labels-new">
+          <label class="mr-2 small text-muted"
+                 for="manage-labels-new"
+                 i18n:translate="">
+            Add a new label
+          </label>
+          <div class="d-flex" style="gap: .5rem">
+            <input type="text"
+                   id="manage-labels-new"
+                   class="form-control form-control-sm"
+                   name="new_label"
+                   placeholder="label name"
+                   autocomplete="off"
+                   i18n:attributes="placeholder" />
+            <input type="color"
+                   id="manage-labels-new-color"
+                   class="manage-labels-color"
+                   name="new_label_color"
+                   tal:attributes="value view/default_new_label_color" />
+            <button type="button"
+                    class="btn btn-sm btn-outline-secondary manage-labels-random"
+                    title="Random color"
+                    i18n:attributes="title">
+              &#x1F3B2;
+            </button>
+          </div>
+          <div class="manage-labels-presets mt-2"
+               tal:define="presets view/get_color_presets">
+            <button type="button"
+                    class="manage-labels-preset"
+                    tal:repeat="preset presets"
+                    tal:attributes="
+                      data-color python:preset['color'];
+                      style python:view.swatch_style(preset['color']);
+                      title python:preset['name']" />
+          </div>
+        </div>
+
+        <div class="form-group mt-3">
+          <input class="btn btn-sm btn-primary"
+                 type="submit"
+                 name="manage_labels"
+                 value="Apply labels"
+                 i18n:attributes="value" />
+        </div>
+
+        <input type="hidden" name="submitted" value="1" />
+        <input type="hidden" name="selected_labels" value=""
+               tal:attributes="value python:','.join(view.get_union_labels())" />
+        <input type="hidden" name="initial_labels" value=""
+               tal:attributes="value python:','.join(view.get_union_labels())" />
+        <input tal:replace="structure context/@@authenticator/authenticator" />
+        <input type="hidden" name="uids" value=""
+               tal:attributes="value request/uids" />
+      </form>
+    </div>
+  </div>
+
+  <script type="text/javascript"
+          tal:attributes="src string:${context/portal_url}/++plone++senaite.core.static/js/senaite.core.modal.manage_labels.js"></script>
+</div>
diff --git a/src/senaite/core/browser/samples/view.py b/src/senaite/core/browser/samples/view.py
index aa3ddfa5af..c30ae7115b 100644
--- a/src/senaite/core/browser/samples/view.py
+++ b/src/senaite/core/browser/samples/view.py
@@ -83,6 +83,8 @@ class SamplesView(ListingView):
     edit_icon_column = "getId"
     # Open the SENAITE sample view (not the generic /edit form)
     edit_view = ""
+    # Pin label chips under the Sample ID column
+    label_target_column = "getId"
 
     def __init__(self, context, request):
         super(SamplesView, self).__init__(context, request)
@@ -720,6 +722,17 @@ def add_custom_transitions(self):
                 "help": _("Create a new worksheet for the selected samples")
             })
 
+        # Allow to add labels to the selected samples
+        if self.can_manage_labels():
+            custom_transitions.append({
+                "id": "modal_manage_labels",
+                "title": _("Labels"),
+                "url": "{}/manage_labels_modal".format(
+                    api.get_url(self.context)),
+                "css_class": "btn btn-outline-secondary",
+                "help": _("Add or remove labels on the selected samples"),
+            })
+
         for rv in self.review_states:
             rv.setdefault("custom_transitions", []).extend(custom_transitions)
 
diff --git a/src/senaite/core/browser/static/js/senaite.core.modal.manage_labels.js b/src/senaite/core/browser/static/js/senaite.core.modal.manage_labels.js
new file mode 100644
index 0000000000..fad0aa7ab1
--- /dev/null
+++ b/src/senaite/core/browser/static/js/senaite.core.modal.manage_labels.js
@@ -0,0 +1,83 @@
+/* Manage Labels modal — toggle chip selection, sync hidden field,
+ * wire color presets and the random button.
+ *
+ * Loaded by `senaite/core/browser/modals/templates/manage_labels.pt`
+ * via `++plone++senaite.core.static/js/senaite.core.modal.manage_labels.js`.
+ *
+ * The script is tolerant to multiple modal opens: it scopes every
+ * query to the form element it finds and bails out silently when
+ * the modal markup is not present.
+ */
+(function() {
+  "use strict";
+
+  function init() {
+    var form = document.querySelector(".manage-labels-form");
+    if (!form) return;
+
+    var selectedField = form.querySelector(
+      'input[name="selected_labels"]');
+    var newInput = form.querySelector('input[name="new_label"]');
+    var colorInput = form.querySelector('input[name="new_label_color"]');
+    var toggles = form.querySelectorAll(".manage-labels-toggle");
+    var presets = form.querySelectorAll(".manage-labels-preset");
+    var randomBtn = form.querySelector(".manage-labels-random");
+
+    function syncSelectedField() {
+      var picked = [];
+      toggles.forEach(function(btn) {
+        if (btn.getAttribute("data-selected") === "1") {
+          picked.push(btn.getAttribute("data-label"));
+        }
+      });
+      if (selectedField) {
+        selectedField.value = picked.join(",");
+      }
+    }
+
+    function onToggleClick(event) {
+      var btn = event.currentTarget;
+      var on = btn.getAttribute("data-selected") === "1";
+      btn.setAttribute("data-selected", on ? "0" : "1");
+      btn.classList.toggle("is-selected", !on);
+      btn.classList.toggle("is-removed", on);
+      syncSelectedField();
+    }
+
+    function onPresetClick(event) {
+      if (!colorInput) return;
+      colorInput.value = event.currentTarget.getAttribute("data-color");
+    }
+
+    function onRandomClick() {
+      if (!colorInput) return;
+      var hex = "#" + Math.floor(Math.random() * 0xffffff)
+        .toString(16).padStart(6, "0");
+      colorInput.value = hex;
+    }
+
+    toggles.forEach(function(btn) {
+      btn.addEventListener("click", onToggleClick);
+      if (btn.getAttribute("data-selected") === "1") {
+        btn.classList.add("is-selected");
+      }
+    });
+    presets.forEach(function(sw) {
+      sw.addEventListener("click", onPresetClick);
+    });
+    if (randomBtn) {
+      randomBtn.addEventListener("click", onRandomClick);
+    }
+
+    syncSelectedField();
+    if (newInput) newInput.focus();
+  }
+
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", init);
+  } else {
+    // Modal markup is already in the DOM (the listing controller
+    // injects it after the document is ready).
+    init();
+  }
+})();
diff --git a/src/senaite/core/browser/viewlets/configure.zcml b/src/senaite/core/browser/viewlets/configure.zcml
index c51213e1cd..bc4a02e0f0 100644
--- a/src/senaite/core/browser/viewlets/configure.zcml
+++ b/src/senaite/core/browser/viewlets/configure.zcml
@@ -14,6 +14,7 @@
       layer="senaite.core.interfaces.ISenaiteCore"
       />
 
+
   <!-- Listing Table: Title Viewlet -->
   <browser:viewlet
       name="senaite.core.listings.title"
diff --git a/src/senaite/core/browser/viewlets/sampleheader.py b/src/senaite/core/browser/viewlets/sampleheader.py
index 221e9eb3f4..6b883f2d2d 100644
--- a/src/senaite/core/browser/viewlets/sampleheader.py
+++ b/src/senaite/core/browser/viewlets/sampleheader.py
@@ -148,6 +148,16 @@ def is_visible(name):
         prominent_fields = filter(is_visible, settings.get("prominent_fields"))
         standard_fields = filter(is_visible, settings.get("standard_fields"))
 
+        # filter out fields the current user has no read or write
+        # permission on, so neither the field's label cell nor an
+        # empty value cell render. Note: required for fields with a
+        # `read_permission` other than the default View permission
+        # (e.g. Labels, gated by ViewLabels).
+        prominent_fields = filter(self._user_can_see_field,
+                                  prominent_fields)
+        standard_fields = filter(self._user_can_see_field,
+                                 standard_fields)
+
         config = {}
         config.update(settings)
         config["prominent_fields"] = prominent_fields
@@ -193,6 +203,18 @@ def grouper(self, iterable, n=3):
         for chunk in iter(lambda it=iter(iterable): list(islice(it, n)), []):
             yield chunk
 
+    def _user_can_see_field(self, name):
+        """True if the current user has read or write permission on
+        the named field. Used to filter out fields entirely from the
+        header table (label cell + value cell) when the user is not
+        allowed to see them.
+        """
+        field = self.fields.get(name)
+        if field is None:
+            return False
+        return (field.checkPermission("view", self.context)
+                or field.checkPermission("edit", self.context))
+
     def get_field_info(self, name):
         """Return field information required for the template
         """
@@ -250,13 +272,22 @@ def get_field_mode(self, field, default="hidden"):
 
           - edit: field is rendered in edit mode
           - view: field is rendered in view mode
+          - <default>: hidden — user has neither write nor read
+            permission, so the field is not rendered at all
         """
-        mode = "view"
         if field.checkPermission("edit", self.context):
             mode = "edit"
             self.show_save = True
         elif field.checkPermission("view", self.context):
             mode = "view"
+        else:
+            # No permission to write *or* read — hide the field
+            # entirely. Without this branch the initial mode='view'
+            # leaked through and the field rendered in view mode
+            # regardless of the field's read_permission, defeating
+            # any per-field gating (e.g. the Labels field's
+            # ViewLabels / ManageLabels guards).
+            return default
 
         widget = self.get_widget(field)
         mode_vis = widget.isVisible(self.context, mode=mode, field=field)
diff --git a/src/senaite/core/catalog/sample_catalog.py b/src/senaite/core/catalog/sample_catalog.py
index eb1a6ce2d3..bd59d3f8c4 100644
--- a/src/senaite/core/catalog/sample_catalog.py
+++ b/src/senaite/core/catalog/sample_catalog.py
@@ -51,6 +51,7 @@
     ("getSamplingDate", "", "DateIndex"),
     ("isRootAncestor", "", "BooleanIndex"),
     ("is_received", "", "BooleanIndex"),
+    ("labels", "", "KeywordIndex"),
     # https://zope.readthedocs.io/en/latest/zopebook/SearchingZCatalog.html
     ("listing_searchable_text", "", "ZCTextIndex"),
     ("modified", "", "DateIndex"),
@@ -79,6 +80,7 @@
     "getDueDate",
     "getInternalUse",
     "getInvoiceExclude",
+    "getLabels",
     "getPrinted",
     "getPrioritySortkey",
     "getProfilesTitleStr",
diff --git a/src/senaite/core/catalog/setup_catalog.py b/src/senaite/core/catalog/setup_catalog.py
index c40665b4ec..6588ba7513 100644
--- a/src/senaite/core/catalog/setup_catalog.py
+++ b/src/senaite/core/catalog/setup_catalog.py
@@ -56,6 +56,7 @@
     # attribute name
     "Description",
     "Type",
+    "getColor",  # Label color (used by chip rendering)
     "description",
     "getCategoryUID",
     "getClientUID",
diff --git a/src/senaite/core/config/labels.py b/src/senaite/core/config/labels.py
new file mode 100644
index 0000000000..e668c0200d
--- /dev/null
+++ b/src/senaite/core/config/labels.py
@@ -0,0 +1,52 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+# Annotation key holding the tuple of assigned label names on a
+# labeled object. Set / read via senaite.core.api.label.
+LABEL_STORAGE = "senaite.core.labels"
+
+# Annotation key on a Label content item carrying the last-known
+# title. Read by the rename-cascade subscriber to detect title
+# changes and rewrite stored names across all labeled objects.
+PREVIOUS_TITLE_KEY = "senaite.core.label.previous_title"
+
+# Catalog index name re-fetched on every label add / remove so
+# listings, the click-to-filter URL and the saved-filter presets
+# see the change in the same transaction.
+SAMPLE_LABEL_REINDEX = ["labels"]
+
+# Default color seeded into the Manage Labels modal's color picker
+# when the user types a new free-text label. SENAITE blue accent.
+DEFAULT_LABEL_COLOR = u"#0d6efd"
+
+# Curated preset palette for the Manage Labels modal's color picker.
+# Mid-saturation values picked so white chip text stays readable.
+# Names are i18n-stable English keys used as preset button tooltips.
+LABEL_COLOR_PRESETS = [
+    ("Red", u"#d33a3a"),
+    ("Orange", u"#e8852b"),
+    ("Yellow", u"#d4a017"),
+    ("Green", u"#2f9e44"),
+    ("Teal", u"#0d9488"),
+    ("Blue", u"#0d6efd"),
+    ("Purple", u"#7c3aed"),
+    ("Pink", u"#db2777"),
+    ("Slate", u"#475569"),
+]
diff --git a/src/senaite/core/content/label.py b/src/senaite/core/content/label.py
index 56cc535d9d..9e5e194dd7 100644
--- a/src/senaite/core/content/label.py
+++ b/src/senaite/core/content/label.py
@@ -19,12 +19,15 @@
 # Some rights reserved, see README and LICENSE.
 
 from bika.lims import senaiteMessageFactory as _
+from plone.autoform.interfaces import IDisplayForm
+from plone.autoform import directives
 from plone.supermodel import model
 from senaite.core.catalog import SETUP_CATALOG
 from senaite.core.content.base import Container
 from senaite.core.interfaces import IHideActionsMenu
 from senaite.core.api import label as label_api
 from senaite.core.interfaces import ILabel
+from senaite.core.schema.colorfield import ColorField
 from zope import schema
 from zope.interface import Invalid
 from zope.interface import implementer
@@ -39,6 +42,13 @@ class ILabelSchema(model.Schema):
             u"title_label_title",
             default=u"Name"
         ),
+        description=_(
+            u"description_label_title",
+            default=u"Renaming this label rewrites the stored name "
+                    u"on every currently labeled content. The cascade "
+                    u"runs in the same transaction as the save and may "
+                    u"take a moment on large datasets."
+        ),
         required=True,
     )
 
@@ -50,6 +60,24 @@ class ILabelSchema(model.Schema):
         required=False,
     )
 
+    # Hide the color row on the display view — a viewlet renders the
+    # swatch next to the title instead. The field is still editable
+    # in the add / edit forms via the ColorField widget.
+    directives.mode(IDisplayForm, color="hidden")
+    color = ColorField(
+        title=_(
+            u"title_label_color",
+            default=u"Color"
+        ),
+        description=_(
+            u"description_label_color",
+            default=u"Hex color code used for the chip "
+                    u"(e.g. #0d6efd). Leave empty for the default style."
+        ),
+        required=False,
+        default=u"",
+    )
+
     @invariant
     def validate_title(data):
         """Checks if the title is unique
@@ -70,3 +98,14 @@ class Label(Container):
     """A container for labels
     """
     _catalogs = [SETUP_CATALOG]
+
+    def getColor(self):
+        """Return the configured chip color as a unicode hex string.
+
+        Exposed as a catalog metadata column on senaite_catalog_setup
+        so chip-rendering consumers can read the color from the brain
+        without waking the Label object. Always returns a unicode
+        value (empty string for unset / invalid colors).
+        """
+        value = getattr(self, "color", u"") or u""
+        return value if isinstance(value, unicode) else value.decode("utf-8")
diff --git a/src/senaite/core/extender/label.py b/src/senaite/core/extender/label.py
index 25ea20b47b..543ddd9a1b 100644
--- a/src/senaite/core/extender/label.py
+++ b/src/senaite/core/extender/label.py
@@ -23,13 +23,14 @@
 from archetypes.schemaextender.interfaces import ISchemaExtender
 from archetypes.schemaextender.interfaces import ISchemaModifier
 from bika.lims import senaiteMessageFactory as _
-from Products.CMFCore import permissions
 from senaite.core.browser.widgets.queryselect import QuerySelectWidget
 from senaite.core.catalog import SETUP_CATALOG
 from senaite.core.config.fields import AT_LABEL_FIELD
 from senaite.core.extender import ExtLabelField
 from senaite.core.interfaces import ICanHaveLabels
 from senaite.core.interfaces import ISenaiteCore
+from senaite.core.permissions import ManageLabels
+from senaite.core.permissions import ViewLabels
 from zope.component import adapts
 from zope.interface import implements
 
@@ -51,8 +52,11 @@ class LabelSchemaExtender(object):
             required=False,
             mode="rw",
             schemata="Labels",
-            read_permission=permissions.View,
-            write_permission=permissions.ModifyPortalContent,
+            # Same gating as the listing chips and the modal:
+            # client users (no ViewLabels) see neither the field nor
+            # the chooser; only ManageLabels can write.
+            read_permission=ViewLabels,
+            write_permission=ManageLabels,
             widget=QuerySelectWidget(
                 label=_("Labels"),
                 description=_("Attached labels"),
diff --git a/src/senaite/core/permissions/__init__.py b/src/senaite/core/permissions/__init__.py
index 47d4cdda53..0fa983ffba 100644
--- a/src/senaite/core/permissions/__init__.py
+++ b/src/senaite/core/permissions/__init__.py
@@ -175,6 +175,8 @@
 ManageSenaite = "senaite.core: Manage Bika"
 ManageAnalysisRequests = "senaite.core: Manage Analysis Requests"
 ManageInvoices = "senaite.core: Manage Invoices"
+ManageLabels = "senaite.core: Manage Labels"
+ViewLabels = "senaite.core: View Labels"
 ManageLoginDetails = "senaite.core: Manage Login Details"
 ManageReference = "senaite.core: Manage Reference"
 ViewResults = "senaite.core: View Results"
diff --git a/src/senaite/core/permissions/configure.zcml b/src/senaite/core/permissions/configure.zcml
index 7a73c720a2..78357fd04a 100644
--- a/src/senaite/core/permissions/configure.zcml
+++ b/src/senaite/core/permissions/configure.zcml
@@ -97,6 +97,8 @@
   <permission id="senaite.core.permissions.ManageBika" title="senaite.core: Manage Bika"/>
   <permission id="senaite.core.permissions.ManageAnalysisRequests" title="senaite.core: Manage Analysis Requests"/>
   <permission id="senaite.core.permissions.ManageInvoices" title="senaite.core: Manage Invoices"/>
+  <permission id="senaite.core.permissions.ManageLabels" title="senaite.core: Manage Labels"/>
+  <permission id="senaite.core.permissions.ViewLabels" title="senaite.core: View Labels"/>
   <permission id="senaite.core.permissions.ManageLoginDetails" title="senaite.core: Manage Login Details"/>
   <permission id="senaite.core.permissions.ManageReference" title="senaite.core: Manage Reference"/>
   <permission id="senaite.core.permissions.ViewResults" title="senaite.core: View Results"/>
diff --git a/src/senaite/core/profiles/default/metadata.xml b/src/senaite/core/profiles/default/metadata.xml
index dcf92e33cf..1dc6eb3fb4 100644
--- a/src/senaite/core/profiles/default/metadata.xml
+++ b/src/senaite/core/profiles/default/metadata.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <metadata>
-  <version>2745</version>
+  <version>2746</version>
   <dependencies>
     <dependency>profile-Products.ATContentTypes:base</dependency>
     <dependency>profile-senaite.impress:default</dependency>
diff --git a/src/senaite/core/profiles/default/rolemap.xml b/src/senaite/core/profiles/default/rolemap.xml
index aa768bb04b..b13abf33fb 100644
--- a/src/senaite/core/profiles/default/rolemap.xml
+++ b/src/senaite/core/profiles/default/rolemap.xml
@@ -688,6 +688,23 @@
       <role name="LabManager"/>
       <role name="Manager"/>
     </permission>
+    <permission name="senaite.core: Manage Labels" acquire="False">
+      <role name="LabClerk"/>
+      <role name="LabManager"/>
+      <role name="Manager"/>
+    </permission>
+    <permission name="senaite.core: View Labels" acquire="False">
+      <role name="Analyst"/>
+      <role name="LabClerk"/>
+      <role name="LabManager"/>
+      <role name="Manager"/>
+      <role name="Preserver"/>
+      <role name="Publisher"/>
+      <role name="RegulatoryInspector"/>
+      <role name="Sampler"/>
+      <role name="SamplingCoordinator"/>
+      <role name="Verifier"/>
+    </permission>
     <permission name="senaite.core: Manage Login Details" acquire="False">
       <role name="LabManager"/>
       <role name="Manager"/>
diff --git a/src/senaite/core/schema/colorfield.py b/src/senaite/core/schema/colorfield.py
new file mode 100644
index 0000000000..d72e450ca0
--- /dev/null
+++ b/src/senaite/core/schema/colorfield.py
@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+import re
+
+from senaite.core.schema.interfaces import IColorField
+from senaite.core.schema.textlinefield import TextLineField
+from zope.interface import implementer
+from zope.schema import ValidationError
+
+
+HEX_COLOR_RE = re.compile(r"^#[0-9a-fA-F]{6}$")
+
+
+class InvalidColorValue(ValidationError):
+    __doc__ = u"Color value must be a 6-digit hex string (#rrggbb)."
+
+
+@implementer(IColorField)
+class ColorField(TextLineField):
+    """A field storing a 6-digit hex color string `#rrggbb`.
+
+    Renders as the native HTML5 `<input type="color">` picker in the
+    edit form. An empty value is allowed when `required=False`.
+    """
+
+    def _validate(self, value):
+        super(ColorField, self)._validate(value)
+        if not value:
+            return
+        if not HEX_COLOR_RE.match(value):
+            raise InvalidColorValue(value)
diff --git a/src/senaite/core/schema/interfaces.py b/src/senaite/core/schema/interfaces.py
index 61b678f143..e9be963c0d 100644
--- a/src/senaite/core/schema/interfaces.py
+++ b/src/senaite/core/schema/interfaces.py
@@ -85,6 +85,11 @@ class IPhoneField(ITextLine):
     """
 
 
+class IColorField(ITextLine):
+    """Color picker field — value is a 6-digit hex string ``#rrggbb``.
+    """
+
+
 class IDurationField(ITimedelta):
     """Senaite Duration field
     """
diff --git a/src/senaite/core/subscribers/configure.zcml b/src/senaite/core/subscribers/configure.zcml
index a0a7ef9df2..b0e11beb1a 100644
--- a/src/senaite/core/subscribers/configure.zcml
+++ b/src/senaite/core/subscribers/configure.zcml
@@ -68,4 +68,19 @@
            zope.lifecycleevent.interfaces.IObjectAddedEvent"
       handler=".intid.drop_intid_for_temporary_object"/>
 
+  <!-- Label rename cascade: the persistent annotation on the Label
+       records the last-known title; the modified handler compares
+       against it and rewrites the stored name on every labeled
+       content if the title changed. Seeded on add so the first
+       edit has a baseline. -->
+  <subscriber
+      for="senaite.core.interfaces.ILabel
+           zope.lifecycleevent.interfaces.IObjectAddedEvent"
+      handler=".label.on_label_added"/>
+
+  <subscriber
+      for="senaite.core.interfaces.ILabel
+           zope.lifecycleevent.interfaces.IObjectModifiedEvent"
+      handler=".label.on_label_modified"/>
+
 </configure>
diff --git a/src/senaite/core/subscribers/label.py b/src/senaite/core/subscribers/label.py
new file mode 100644
index 0000000000..f5573562f0
--- /dev/null
+++ b/src/senaite/core/subscribers/label.py
@@ -0,0 +1,108 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+from bika.lims import api
+from senaite.core import logger
+from senaite.core.api import label as label_api
+from senaite.core.catalog import LABEL_CATALOG
+from senaite.core.config.labels import PREVIOUS_TITLE_KEY
+from senaite.core.config.labels import SAMPLE_LABEL_REINDEX
+from zope.annotation.interfaces import IAnnotations
+
+
+def on_label_added(label, event):
+    """Record the initial title as the rename baseline.
+
+    Fires when a `Label` is added to `setup.labels`. We seed the
+    persistent annotation here so the first edit can compare against
+    a known baseline rather than treating every modification as a
+    rename.
+    """
+    title = api.safe_unicode(label.title or u"")
+    IAnnotations(label)[PREVIOUS_TITLE_KEY] = title
+
+
+def on_label_modified(label, event):
+    """Cascade a Label title rename across every labeled content.
+
+    Reads the previous title from the persistent annotation on the
+    Label itself. If the title actually changed, walks the label
+    catalog (`senaite_catalog_label` only indexes objects providing
+    `IHaveLabels`) and rewrites the stored name on each, then
+    reindexes the `labels` index so listings, filters and the color
+    map see the rename immediately.
+
+    Pre-existing Labels created before the subscriber was installed
+    have no annotation yet — the first modification seeds the
+    baseline rather than firing a false-positive cascade.
+    """
+    annotations = IAnnotations(label)
+    new_title = api.safe_unicode(label.title or u"")
+    old_title = annotations.get(PREVIOUS_TITLE_KEY)
+
+    if old_title is None:
+        # First modification after install / first save after upgrade.
+        # Seed the baseline; no rename to cascade.
+        annotations[PREVIOUS_TITLE_KEY] = new_title
+        return
+
+    if old_title == new_title:
+        return
+
+    affected = _rename_label_in_storage(old_title, new_title)
+    annotations[PREVIOUS_TITLE_KEY] = new_title
+    if affected:
+        logger.info(
+            "Label rename '{}' -> '{}': updated {} content(s)".format(
+                old_title.encode("utf-8"),
+                new_title.encode("utf-8"),
+                affected,
+            )
+        )
+
+
+def _rename_label_in_storage(old_title, new_title):
+    """Walk every labeled object and rewrite `old_title` -> `new_title`.
+
+    Returns the number of objects updated. When `new_title` is
+    already present on an object (merge case), the old entry is
+    dropped rather than duplicated.
+    """
+    catalog = api.get_tool(LABEL_CATALOG)
+    brains = catalog(labels=old_title)
+    affected = 0
+    for brain in brains:
+        obj = api.get_object(brain, default=None)
+        if obj is None:
+            continue
+        labels = list(label_api.get_obj_labels(obj))
+        try:
+            index = labels.index(old_title)
+        except ValueError:
+            # Catalog brain stale; nothing to do here.
+            continue
+        if new_title in labels:
+            labels.pop(index)
+        else:
+            labels[index] = new_title
+        label_api.set_obj_labels(obj, labels)
+        obj.reindexObject(idxs=SAMPLE_LABEL_REINDEX)
+        affected += 1
+    return affected
diff --git a/src/senaite/core/tests/doctests/API_label.rst b/src/senaite/core/tests/doctests/API_label.rst
index 4d9edf339a..3e0b94f0df 100644
--- a/src/senaite/core/tests/doctests/API_label.rst
+++ b/src/senaite/core/tests/doctests/API_label.rst
@@ -218,3 +218,173 @@ Labels can be searched via the API and return all labeled objects:
     >>> results = search_objects_by_label(["SENAITE"])
     >>> len(results) == 3
     True
+
+
+Color helpers
+.............
+
+`is_safe_color` whitelists `#rrggbb` values before they get inlined
+into CSS `style` attributes:
+
+    >>> is_safe_color("#0d6efd")
+    True
+    >>> is_safe_color("#abcdef")
+    True
+    >>> is_safe_color("#ABC")
+    False
+    >>> is_safe_color("blue")
+    False
+    >>> is_safe_color("")
+    False
+    >>> is_safe_color(None)
+    False
+    >>> is_safe_color('"><script>')
+    False
+
+`chip_style` returns the CSS inline style for a chip with the given
+color, or an empty string when the color is unsafe / missing so the
+chip falls back to the default neutral pill:
+
+    >>> chip_style("#0d6efd")
+    u'background-color: #0d6efd; border-color: #0d6efd; color: #fff'
+    >>> chip_style("")
+    u''
+    >>> chip_style('"><script>')
+    u''
+
+
+parse_label_csv
+...............
+
+`parse_label_csv` parses request-shaped values into a sorted list of
+unique non-empty label names:
+
+    >>> parse_label_csv("foo,bar,baz")
+    [u'bar', u'baz', u'foo']
+    >>> parse_label_csv(" foo , foo , bar ")
+    [u'bar', u'foo']
+    >>> parse_label_csv(["foo", "bar,baz"])
+    [u'bar', u'baz', u'foo']
+    >>> parse_label_csv("")
+    []
+    >>> parse_label_csv(None)
+    []
+    >>> parse_label_csv([])
+    []
+
+Non-ASCII names round-trip as unicode so callers can safely pass the
+result to the setup catalog's `title` index:
+
+    >>> parse_label_csv("F\xc3\xbcrth,Spain")
+    [u'F\xfcrth', u'Spain']
+
+
+Label colors
+............
+
+Labels carry an optional hex color used by the listing chips. Setting
+the color on a Label and reading it back via `get_label_colors`:
+
+    >>> from senaite.core.api.label import get_label_by_name
+    >>> from senaite.core.api.label import get_label_colors
+
+    >>> blue = get_label_by_name("Important")
+    >>> blue.color = u"#0d6efd"
+    >>> blue.reindexObject()
+
+    >>> get_label_colors(["Important"]) == {u"Important": u"#0d6efd"}
+    True
+
+`get_label_colors()` without `names` returns the full map. Only
+labels with a color set are included in the map — empty values are
+skipped:
+
+    >>> colors = get_label_colors()
+    >>> colors.get(u"Important")
+    u'#0d6efd'
+    >>> u"Urgent" in colors
+    False
+
+Sample labels and the catalog index
+...................................
+
+Labels added to a sample propagate to the sample catalog `labels`
+index, which the listing uses for click-to-filter. Create a sample
+type and a sample, label it, then verify the catalog query:
+
+    >>> from senaite.core.catalog import SAMPLE_CATALOG
+    >>> sample_catalog = api.get_tool(SAMPLE_CATALOG)
+    >>> "labels" in sample_catalog.indexes()
+    True
+
+Labels propagate to the index for any `IHaveLabels`-providing
+object. `client1` already has labels assigned above and is itself a
+labeled object:
+
+    >>> labels_brains = search_objects_by_label("Spain")
+    >>> client1.UID() in [b.UID for b in labels_brains]
+    True
+
+Removing a label updates the index — `client1` drops out of the
+"Spain" hit list:
+
+    >>> _ = del_obj_labels(client1, "Spain")
+    >>> labels_brains = search_objects_by_label("Spain")
+    >>> client1.UID() in [b.UID for b in labels_brains]
+    False
+
+
+Renaming a Label cascades to all labeled contents
+.................................................
+
+When the title of a `Label` content changes, the rename subscriber
+walks the label catalog and rewrites the stored name on every
+labeled object so storage and listing chips stay in sync.
+
+The cascade is wired through `IEditBegunEvent` (snapshot the old
+title) + `IObjectModifiedEvent` (compare and rewrite). For this
+test we invoke the rename helper directly because the form events
+do not fire from inside doctests:
+
+    >>> from senaite.core.subscribers.label import (
+    ...     _rename_label_in_storage)
+
+`client2` and `client3` carry the "SENAITE" label assigned above.
+Rename it to "SENAITE LIMS" and verify both clients move:
+
+    >>> brains_before = search_objects_by_label("SENAITE")
+    >>> uids_before = sorted([b.UID for b in brains_before])
+    >>> len(uids_before) >= 2
+    True
+
+    >>> affected = _rename_label_in_storage(u"SENAITE", u"SENAITE LIMS")
+    >>> affected == len(uids_before)
+    True
+
+    >>> u"SENAITE" in get_obj_labels(client2)
+    False
+    >>> u"SENAITE LIMS" in get_obj_labels(client2)
+    True
+
+The label catalog index reflects the new name and forgets the old:
+
+    >>> [b.UID for b in search_objects_by_label("SENAITE")]
+    []
+    >>> renamed = search_objects_by_label("SENAITE LIMS")
+    >>> sorted([b.UID for b in renamed]) == uids_before
+    True
+
+Merge case: renaming a label to a name that some objects already
+carry drops the old entry rather than duplicating. Set up a fresh
+pair of labels on a clean object, then collapse them:
+
+    >>> _ = add_obj_labels(client3, [u"Alpha", u"Beta"])
+    >>> sorted(get_obj_labels(client3))
+    [u'Alpha', u'Beta', 'LIMS', u'SENAITE LIMS']
+
+    >>> _ = _rename_label_in_storage(u"Alpha", u"Beta")
+    >>> sorted(get_obj_labels(client3))
+    [u'Beta', 'LIMS', u'SENAITE LIMS']
+
+    >>> get_obj_labels(client3).count(u"Beta")
+    1
diff --git a/src/senaite/core/upgrade/v02_07_000.py b/src/senaite/core/upgrade/v02_07_000.py
index dc5b4b1bf0..e5c9e8ab5d 100644
--- a/src/senaite/core/upgrade/v02_07_000.py
+++ b/src/senaite/core/upgrade/v02_07_000.py
@@ -2181,6 +2181,61 @@ def cleanup_sample_catalog(tool):
     logger.info("Cleaning up sample catalog indexes and columns [DONE]")
 
 
+@upgradestep(product, version)
+def setup_sample_labels(tool):
+    """Register ManageLabels permission and add labels KeywordIndex to
+    senaite_catalog_sample. Reindex so labels on existing samples are
+    queryable via the new index.
+    """
+    portal = tool.aq_inner.aq_parent
+    setup = portal.portal_setup
+
+    logger.info("Importing rolemap for ManageLabels permission ...")
+    setup.runImportStepFromProfile(profile, "rolemap")
+
+    logger.info("Adding 'labels' index to sample catalog ...")
+    catalog = api.get_tool(SAMPLE_CATALOG)
+    if add_catalog_index(catalog, "labels", "", "KeywordIndex"):
+        logger.info("Reindexing 'labels' in sample catalog ...")
+        reindex_index(SAMPLE_CATALOG, "labels")
+        logger.info("Reindexing 'labels' in sample catalog [DONE]")
+
+    logger.info("Adding 'getLabels' column to sample catalog ...")
+    add_catalog_column(catalog, "getLabels")
+
+    logger.info("Adding 'getColor' column to setup catalog ...")
+    setup_catalog = api.get_tool(SETUP_CATALOG)
+    add_catalog_column(setup_catalog, "getColor")
+    # The pre-release of this PR used a bare 'color' attribute column;
+    # drop it if present so the catalog reflects the final method-call
+    # convention.
+    if "color" in setup_catalog.schema():
+        del_column(setup_catalog, "color")
+    label_brains = setup_catalog(portal_type="Label")
+    logger.info("Refreshing %s Label brains for color metadata "
+                "and seeding rename-cascade baseline ..."
+                % len(label_brains))
+    # The label rename subscriber reads `PREVIOUS_TITLE_KEY` from
+    # each Label's annotations to detect title changes; seed it for
+    # every pre-existing Label so the *first* post-upgrade rename
+    # actually cascades rather than being treated as the baseline.
+    from senaite.core.config.labels import PREVIOUS_TITLE_KEY
+    from zope.annotation.interfaces import IAnnotations
+    for brain in label_brains:
+        obj = api.get_object(brain, default=None)
+        if obj is None:
+            logger.warn("Could not wake Label brain '%s'" % brain.UID)
+            continue
+        # No idxs= so the metadata columns get refreshed too.
+        obj.reindexObject()
+        annotations = IAnnotations(obj)
+        if PREVIOUS_TITLE_KEY not in annotations:
+            annotations[PREVIOUS_TITLE_KEY] = api.safe_unicode(
+                obj.title or u"")
+
+    logger.info("Setup sample labels [DONE]")
+
+
 @upgradestep(product, version)
 def add_sample_catalog_indexes(tool):
     """Add new indexes to senaite_catalog_sample
diff --git a/src/senaite/core/upgrade/v02_07_000.zcml b/src/senaite/core/upgrade/v02_07_000.zcml
index 54abdb4bbb..00be36f287 100644
--- a/src/senaite/core/upgrade/v02_07_000.zcml
+++ b/src/senaite/core/upgrade/v02_07_000.zcml
@@ -2,6 +2,19 @@
     xmlns="http://namespaces.zope.org/zope"
     xmlns:genericsetup="http://namespaces.zope.org/genericsetup">
 
+  <genericsetup:upgradeStep
+      title="SENAITE.CORE 2.7.0: Add labels index to sample catalog and ManageLabels permission"
+      description="Register the new `senaite.core: Manage Labels` permission
+                   (granted to LabClerk, LabManager, Manager) and add a
+                   `labels` KeywordIndex to `senaite_catalog_sample` so
+                   sample listings can filter by label. The existing
+                   `IHaveLabels` indexer populates the new index for
+                   already-labeled samples on reindex."
+      source="2745"
+      destination="2746"
+      handler=".v02_07_000.setup_sample_labels"
+      profile="senaite.core:default"/>
+
   <genericsetup:upgradeStep
       title="SENAITE.CORE 2.7.0: Reindex DX client-aware content after IClientAwareMixin interface mismatch fix"
       description="The new `allowedRolesAndUsers` indexer wired by
diff --git a/src/senaite/core/z3cform/interfaces.py b/src/senaite/core/z3cform/interfaces.py
index 978acc9dc6..76d0ea4da1 100644
--- a/src/senaite/core/z3cform/interfaces.py
+++ b/src/senaite/core/z3cform/interfaces.py
@@ -65,6 +65,11 @@ class IPhoneWidget(IWidget):
     """
 
 
+class IColorWidget(IWidget):
+    """Input type "color" widget — renders the native HTML5 picker.
+    """
+
+
 class IQuerySelectWidget(IWidget):
     """Allows to search and select a value
     """
diff --git a/src/senaite/core/z3cform/widgets/color/__init__.py b/src/senaite/core/z3cform/widgets/color/__init__.py
new file mode 100644
index 0000000000..8e2f7d3fc6
--- /dev/null
+++ b/src/senaite/core/z3cform/widgets/color/__init__.py
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
diff --git a/src/senaite/core/z3cform/widgets/color/configure.zcml b/src/senaite/core/z3cform/widgets/color/configure.zcml
new file mode 100644
index 0000000000..4c90ca04e7
--- /dev/null
+++ b/src/senaite/core/z3cform/widgets/color/configure.zcml
@@ -0,0 +1,30 @@
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:z3c="http://namespaces.zope.org/z3c"
+    i18n_domain="z3c.form">
+
+  <!-- Color Widget -->
+  <adapter
+      factory=".widget.ColorWidgetFactory"
+      for="senaite.core.schema.interfaces.IColorField
+           senaite.core.interfaces.ISenaiteFormLayer" />
+
+  <z3c:widgetTemplate
+      mode="input"
+      widget=".widget.ColorWidget"
+      template="input.pt"
+      layer="senaite.core.interfaces.ISenaiteFormLayer" />
+
+  <z3c:widgetTemplate
+      mode="display"
+      widget=".widget.ColorWidget"
+      template="display.pt"
+      layer="senaite.core.interfaces.ISenaiteFormLayer" />
+
+  <z3c:widgetTemplate
+      mode="hidden"
+      widget=".widget.ColorWidget"
+      template="hidden.pt"
+      layer="senaite.core.interfaces.ISenaiteFormLayer" />
+
+</configure>
diff --git a/src/senaite/core/z3cform/widgets/color/display.pt b/src/senaite/core/z3cform/widgets/color/display.pt
new file mode 100644
index 0000000000..fb1f035489
--- /dev/null
+++ b/src/senaite/core/z3cform/widgets/color/display.pt
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      tal:omit-tag="">
+
+  <span class="senaite-color-widget-display d-inline-flex align-items-center"
+        style="gap: .35rem;">
+    <span class="senaite-color-widget-swatch"
+          tal:condition="view/value"
+          tal:attributes="
+            style string:display:inline-block;width:1rem;height:1rem;
+                         border-radius:3px;border:1px solid rgba(0,0,0,.15);
+                         background-color:${view/value};" />
+    <code tal:condition="view/value"
+          style="font-size: .75rem;"
+          tal:content="view/value" />
+    <span tal:condition="not:view/value"
+          class="text-muted"
+          i18n:translate="">(no color)</span>
+  </span>
+</html>
diff --git a/src/senaite/core/z3cform/widgets/color/hidden.pt b/src/senaite/core/z3cform/widgets/color/hidden.pt
new file mode 100644
index 0000000000..5e4e942256
--- /dev/null
+++ b/src/senaite/core/z3cform/widgets/color/hidden.pt
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      tal:omit-tag="">
+
+  <input type="hidden"
+         tal:attributes="
+           id view/id;
+           name view/name;
+           value view/value;" />
+</html>
diff --git a/src/senaite/core/z3cform/widgets/color/input.pt b/src/senaite/core/z3cform/widgets/color/input.pt
new file mode 100644
index 0000000000..f53bb4d670
--- /dev/null
+++ b/src/senaite/core/z3cform/widgets/color/input.pt
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      tal:omit-tag="">
+
+  <!-- Native HTML5 color picker. A small preview swatch sits next to
+       it so the chosen value is readable as text too. -->
+  <span class="senaite-color-widget-wrap d-inline-flex align-items-center"
+        style="gap: .35rem;">
+    <input type="color"
+           tal:attributes="
+             id view/id;
+             name view/name;
+             class string:${view/klass} senaite-color-widget-input;
+             title view/title;
+             value view/value;
+             disabled view/disabled;
+             readonly view/readonly;"
+           style="width: 2.25rem; height: 2.25rem; padding: 2px;
+                  flex: 0 0 2.25rem; border: 1px solid #ced4da;
+                  border-radius: .25rem; background: #fff;
+                  cursor: pointer;" />
+    <code class="senaite-color-widget-value text-muted"
+          style="font-size: .75rem;"
+          tal:content="view/value" />
+  </span>
+</html>
diff --git a/src/senaite/core/z3cform/widgets/color/widget.py b/src/senaite/core/z3cform/widgets/color/widget.py
new file mode 100644
index 0000000000..2b9bc4fafd
--- /dev/null
+++ b/src/senaite/core/z3cform/widgets/color/widget.py
@@ -0,0 +1,54 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of SENAITE.CORE.
+#
+# SENAITE.CORE is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation, version 2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Software Foundation, Inc., 51
+# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright 2018-2025 by it's authors.
+# Some rights reserved, see README and LICENSE.
+
+import zope.interface
+from senaite.core.interfaces import ISenaiteFormLayer
+from senaite.core.schema.interfaces import IColorField
+from senaite.core.z3cform.interfaces import IColorWidget
+from z3c.form import interfaces
+from z3c.form.browser import text
+from z3c.form.browser import widget
+from z3c.form.widget import FieldWidget
+from zope.component import adapter
+from zope.interface import implementer_only
+
+
+@implementer_only(IColorWidget)
+class ColorWidget(text.TextWidget):
+    """Renders an HTML5 `<input type="color">` picker.
+    """
+    klass = u"senaite-color-widget"
+    value = u""
+
+    def update(self):
+        super(ColorWidget, self).update()
+        widget.addFieldClass(self)
+        # NOTE: deliberately do NOT add `form-control` here — it
+        # forces `width: 100%` and stretches the color picker
+        # across the full row. The square footprint comes from the
+        # input template.
+
+
+@adapter(IColorField, ISenaiteFormLayer)
+@zope.interface.implementer(interfaces.IFieldWidget)
+def ColorWidgetFactory(field, request):
+    """IFieldWidget widget factory for ColorWidget.
+    """
+    return FieldWidget(field, ColorWidget(request))
diff --git a/src/senaite/core/z3cform/widgets/configure.zcml b/src/senaite/core/z3cform/widgets/configure.zcml
index 4fb3e37c5b..11b7fd19e4 100644
--- a/src/senaite/core/z3cform/widgets/configure.zcml
+++ b/src/senaite/core/z3cform/widgets/configure.zcml
@@ -3,6 +3,7 @@
     i18n_domain="senaite.core">
 
   <!-- package includes -->
+  <include package=".color" />
   <include package=".coordinate" />
   <include package=".datagrid" />
   <include package=".duration" />