diff --git a/docs/toolhive/reference/cli/thv.md b/docs/toolhive/reference/cli/thv.md
index fdd48eab..60b33bc2 100644
--- a/docs/toolhive/reference/cli/thv.md
+++ b/docs/toolhive/reference/cli/thv.md
@@ -39,6 +39,7 @@ thv [flags]
 * [thv client](thv_client.md)	 - Manage MCP clients
 * [thv config](thv_config.md)	 - Manage application configuration
 * [thv export](thv_export.md)	 - Export a workload's run configuration to a file
+* [thv group](thv_group.md)	 - Manage logical groupings of MCP servers
 * [thv inspector](thv_inspector.md)	 - Launches the MCP Inspector UI and connects it to the specified MCP server
 * [thv list](thv_list.md)	 - List running MCP servers
 * [thv logs](thv_logs.md)	 - Output the logs of an MCP server or manage log files
diff --git a/docs/toolhive/reference/cli/thv_client_register.md b/docs/toolhive/reference/cli/thv_client_register.md
index fbaa8e5c..7015d24f 100644
--- a/docs/toolhive/reference/cli/thv_client_register.md
+++ b/docs/toolhive/reference/cli/thv_client_register.md
@@ -39,7 +39,8 @@ thv client register [client] [flags]
 ### Options
 
 ```
-  -h, --help   help for register
+      --group strings   Only register workloads from specified groups (default [default])
+  -h, --help            help for register
 ```
 
 ### Options inherited from parent commands
diff --git a/docs/toolhive/reference/cli/thv_client_remove.md b/docs/toolhive/reference/cli/thv_client_remove.md
index 21b1eb41..d59782d1 100644
--- a/docs/toolhive/reference/cli/thv_client_remove.md
+++ b/docs/toolhive/reference/cli/thv_client_remove.md
@@ -39,7 +39,8 @@ thv client remove [client] [flags]
 ### Options
 
 ```
-  -h, --help   help for remove
+      --group strings   Remove client from specified groups (if not set, removes all workloads from the client)
+  -h, --help            help for remove
 ```
 
 ### Options inherited from parent commands
diff --git a/docs/toolhive/reference/cli/thv_group.md b/docs/toolhive/reference/cli/thv_group.md
new file mode 100644
index 00000000..d0ec552c
--- /dev/null
+++ b/docs/toolhive/reference/cli/thv_group.md
@@ -0,0 +1,38 @@
+---
+title: thv group
+hide_title: true
+description: Reference for ToolHive CLI command `thv group`
+last_update:
+  author: autogenerated
+slug: thv_group
+mdx:
+  format: md
+---
+
+## thv group
+
+Manage logical groupings of MCP servers
+
+### Synopsis
+
+The group command provides subcommands to manage logical groupings of MCP servers.
+
+### Options
+
+```
+  -h, --help   help for group
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv](thv.md)	 - ToolHive (thv) is a lightweight, secure, and fast manager for MCP servers
+* [thv group create](thv_group_create.md)	 - Create a new group of MCP servers
+* [thv group list](thv_group_list.md)	 - List all groups
+* [thv group rm](thv_group_rm.md)	 - Remove a group and remove workloads from it
+
diff --git a/docs/toolhive/reference/cli/thv_group_create.md b/docs/toolhive/reference/cli/thv_group_create.md
new file mode 100644
index 00000000..8338deb6
--- /dev/null
+++ b/docs/toolhive/reference/cli/thv_group_create.md
@@ -0,0 +1,40 @@
+---
+title: thv group create
+hide_title: true
+description: Reference for ToolHive CLI command `thv group create`
+last_update:
+  author: autogenerated
+slug: thv_group_create
+mdx:
+  format: md
+---
+
+## thv group create
+
+Create a new group of MCP servers
+
+### Synopsis
+
+Create a new logical group of MCP servers.
+		 The group can be used to organize and manage multiple MCP servers together.
+
+```
+thv group create [group-name] [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for create
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv group](thv_group.md)	 - Manage logical groupings of MCP servers
+
diff --git a/docs/toolhive/reference/cli/thv_group_list.md b/docs/toolhive/reference/cli/thv_group_list.md
new file mode 100644
index 00000000..07acb9b5
--- /dev/null
+++ b/docs/toolhive/reference/cli/thv_group_list.md
@@ -0,0 +1,39 @@
+---
+title: thv group list
+hide_title: true
+description: Reference for ToolHive CLI command `thv group list`
+last_update:
+  author: autogenerated
+slug: thv_group_list
+mdx:
+  format: md
+---
+
+## thv group list
+
+List all groups
+
+### Synopsis
+
+List all logical groups of MCP servers.
+
+```
+thv group list [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for list
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv group](thv_group.md)	 - Manage logical groupings of MCP servers
+
diff --git a/docs/toolhive/reference/cli/thv_group_rm.md b/docs/toolhive/reference/cli/thv_group_rm.md
new file mode 100644
index 00000000..dededfe3
--- /dev/null
+++ b/docs/toolhive/reference/cli/thv_group_rm.md
@@ -0,0 +1,40 @@
+---
+title: thv group rm
+hide_title: true
+description: Reference for ToolHive CLI command `thv group rm`
+last_update:
+  author: autogenerated
+slug: thv_group_rm
+mdx:
+  format: md
+---
+
+## thv group rm
+
+Remove a group and remove workloads from it
+
+### Synopsis
+
+Remove a group and remove all MCP servers from it. By default, this only removes the group membership from workloads without deleting them. Use --with-workloads to also delete the workloads. 
+
+```
+thv group rm [group-name] [flags]
+```
+
+### Options
+
+```
+  -h, --help             help for rm
+      --with-workloads   Delete all workloads in the group along with the group
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv group](thv_group.md)	 - Manage logical groupings of MCP servers
+
diff --git a/docs/toolhive/reference/cli/thv_list.md b/docs/toolhive/reference/cli/thv_list.md
index d76ac61a..b164a632 100644
--- a/docs/toolhive/reference/cli/thv_list.md
+++ b/docs/toolhive/reference/cli/thv_list.md
@@ -26,6 +26,7 @@ thv list [flags]
 ```
   -a, --all                 Show all workloads (default shows just running)
       --format string       Output format (json, text, or mcpservers) (default "text")
+      --group string        Filter workloads by group
   -h, --help                help for list
   -l, --label stringArray   Filter workloads by labels (format: key=value)
 ```
diff --git a/docs/toolhive/reference/cli/thv_mcp_list.md b/docs/toolhive/reference/cli/thv_mcp_list.md
index 43db120b..268e4d8e 100644
--- a/docs/toolhive/reference/cli/thv_mcp_list.md
+++ b/docs/toolhive/reference/cli/thv_mcp_list.md
@@ -26,7 +26,7 @@ thv mcp list [tools|resources|prompts] [flags]
 ```
       --format string      Output format (json or text) (default "text")
   -h, --help               help for list
-      --server string      MCP server URL (required)
+      --server string      MCP server URL or name from ToolHive registry (required)
       --timeout duration   Connection timeout (default 30s)
       --transport string   Transport type (auto, sse, streamable-http) (default "auto")
 ```
diff --git a/docs/toolhive/reference/cli/thv_mcp_list_prompts.md b/docs/toolhive/reference/cli/thv_mcp_list_prompts.md
index 2d762fc1..a2dc33c1 100644
--- a/docs/toolhive/reference/cli/thv_mcp_list_prompts.md
+++ b/docs/toolhive/reference/cli/thv_mcp_list_prompts.md
@@ -26,7 +26,7 @@ thv mcp list prompts [flags]
 ```
       --format string      Output format (json or text) (default "text")
   -h, --help               help for prompts
-      --server string      MCP server URL (required)
+      --server string      MCP server URL or name from ToolHive registry (required)
       --timeout duration   Connection timeout (default 30s)
       --transport string   Transport type (auto, sse, streamable-http) (default "auto")
 ```
diff --git a/docs/toolhive/reference/cli/thv_mcp_list_resources.md b/docs/toolhive/reference/cli/thv_mcp_list_resources.md
index 14ebee0c..9a07c611 100644
--- a/docs/toolhive/reference/cli/thv_mcp_list_resources.md
+++ b/docs/toolhive/reference/cli/thv_mcp_list_resources.md
@@ -26,7 +26,7 @@ thv mcp list resources [flags]
 ```
       --format string      Output format (json or text) (default "text")
   -h, --help               help for resources
-      --server string      MCP server URL (required)
+      --server string      MCP server URL or name from ToolHive registry (required)
       --timeout duration   Connection timeout (default 30s)
       --transport string   Transport type (auto, sse, streamable-http) (default "auto")
 ```
diff --git a/docs/toolhive/reference/cli/thv_mcp_list_tools.md b/docs/toolhive/reference/cli/thv_mcp_list_tools.md
index 5227aebb..96c48213 100644
--- a/docs/toolhive/reference/cli/thv_mcp_list_tools.md
+++ b/docs/toolhive/reference/cli/thv_mcp_list_tools.md
@@ -26,7 +26,7 @@ thv mcp list tools [flags]
 ```
       --format string      Output format (json or text) (default "text")
   -h, --help               help for tools
-      --server string      MCP server URL (required)
+      --server string      MCP server URL or name from ToolHive registry (required)
       --timeout duration   Connection timeout (default 30s)
       --transport string   Transport type (auto, sse, streamable-http) (default "auto")
 ```
diff --git a/docs/toolhive/reference/cli/thv_restart.md b/docs/toolhive/reference/cli/thv_restart.md
index 332cb478..d1c06d1c 100644
--- a/docs/toolhive/reference/cli/thv_restart.md
+++ b/docs/toolhive/reference/cli/thv_restart.md
@@ -24,9 +24,10 @@ thv restart [workload-name] [flags]
 ### Options
 
 ```
-  -a, --all          Restart all MCP servers
-  -f, --foreground   Run the restarted workload in foreground mode
-  -h, --help         help for restart
+  -a, --all            Restart all MCP servers
+  -f, --foreground     Run the restarted workload in foreground mode
+  -g, --group string   Restart all MCP servers in a specific group
+  -h, --help           help for restart
 ```
 
 ### Options inherited from parent commands
diff --git a/docs/toolhive/reference/cli/thv_rm.md b/docs/toolhive/reference/cli/thv_rm.md
index 9db5b43c..ceefd84c 100644
--- a/docs/toolhive/reference/cli/thv_rm.md
+++ b/docs/toolhive/reference/cli/thv_rm.md
@@ -24,7 +24,8 @@ thv rm [workload-name] [flags]
 ### Options
 
 ```
-  -h, --help   help for rm
+      --group string   Delete all workloads in the specified group
+  -h, --help           help for rm
 ```
 
 ### Options inherited from parent commands
diff --git a/docs/toolhive/reference/cli/thv_run.md b/docs/toolhive/reference/cli/thv_run.md
index 49448e91..f0532d38 100644
--- a/docs/toolhive/reference/cli/thv_run.md
+++ b/docs/toolhive/reference/cli/thv_run.md
@@ -65,8 +65,11 @@ thv run [flags] SERVER_OR_IMAGE_OR_PROTOCOL [-- ARGS...]
       --ca-cert string                        Path to a custom CA certificate file to use for container builds
       --enable-audit                          Enable audit logging with default configuration
   -e, --env stringArray                       Environment variables to pass to the MCP server (format: KEY=VALUE)
+      --env-file string                       Load environment variables from a single file
+      --env-file-dir string                   Load environment variables from all files in a directory
   -f, --foreground                            Run in foreground mode (block until container exits)
       --from-config string                    Load configuration from exported file
+      --group string                          Name of the group this workload belongs to (defaults to 'default' if not specified) (default "default")
   -h, --help                                  help for run
       --host string                           Host for the HTTP proxy to listen on (IP or hostname) (default "127.0.0.1")
       --ignore-globally                       Load global ignore patterns from ~/.config/toolhive/thvignore (default true)
diff --git a/docs/toolhive/reference/cli/thv_stop.md b/docs/toolhive/reference/cli/thv_stop.md
index 93b7ad35..7345648a 100644
--- a/docs/toolhive/reference/cli/thv_stop.md
+++ b/docs/toolhive/reference/cli/thv_stop.md
@@ -24,9 +24,10 @@ thv stop [workload-name] [flags]
 ### Options
 
 ```
-      --all           Stop all running MCP servers
-  -h, --help          help for stop
-      --timeout int   Timeout in seconds before forcibly stopping the workload (default 30)
+      --all            Stop all running MCP servers
+  -g, --group string   Stop all MCP servers in a specific group
+  -h, --help           help for stop
+      --timeout int    Timeout in seconds before forcibly stopping the workload (default 30)
 ```
 
 ### Options inherited from parent commands
diff --git a/static/api-specs/toolhive-api.yaml b/static/api-specs/toolhive-api.yaml
index 53a93b1c..6ec8e3ed 100644
--- a/static/api-specs/toolhive-api.yaml
+++ b/static/api-specs/toolhive-api.yaml
@@ -107,11 +107,6 @@ components:
       type: string
       x-enum-varnames:
       - ConfigTypeCedarV1
-    client.Client:
-      properties:
-        name:
-          $ref: '#/components/schemas/client.MCPClient'
-      type: object
     client.MCPClient:
       type: string
       x-enum-varnames:
@@ -156,6 +151,16 @@ components:
             ToolHive configuration
           type: boolean
       type: object
+    client.RegisteredClient:
+      properties:
+        groups:
+          items:
+            type: string
+          type: array
+          uniqueItems: false
+        name:
+          $ref: '#/components/schemas/client.MCPClient'
+      type: object
     core.Workload:
       properties:
         created_at:
@@ -654,10 +659,6 @@ components:
           description: IsolateNetwork indicates whether to isolate the network for
             the container
           type: boolean
-        jwks_allow_private_ip:
-          description: JWKSAllowPrivateIP allows JWKS/OIDC endpoints on private IP
-            addresses
-          type: boolean
         jwks_auth_token_file:
           description: JWKSAuthTokenFile is the path to file containing auth token
             for JWKS/OIDC requests
@@ -691,6 +692,9 @@ components:
           type: integer
         proxy_mode:
           $ref: '#/components/schemas/types.ProxyMode'
+        schema_version:
+          description: SchemaVersion is the version of the RunConfig schema
+          type: string
         secrets:
           description: |-
             Secrets are the secret parameters to pass to the container
@@ -1247,6 +1251,65 @@ components:
           description: Type of the secrets provider that was setup
           type: string
       type: object
+    v1.updateRequest:
+      description: Request to update an existing workload (name cannot be changed)
+      properties:
+        authz_config:
+          description: Authorization configuration
+          type: string
+        cmd_arguments:
+          description: Command arguments to pass to the container
+          items:
+            type: string
+          type: array
+          uniqueItems: false
+        env_vars:
+          additionalProperties:
+            type: string
+          description: Environment variables to set in the container
+          type: object
+        host:
+          description: Host to bind to
+          type: string
+        image:
+          description: Docker image to use
+          type: string
+        network_isolation:
+          description: Whether network isolation is turned on. This applies the rules
+            in the permission profile.
+          type: boolean
+        oidc:
+          $ref: '#/components/schemas/v1.oidcOptions'
+        permission_profile:
+          $ref: '#/components/schemas/permissions.Profile'
+        proxy_mode:
+          description: Proxy mode to use
+          type: string
+        secrets:
+          description: Secret parameters to inject
+          items:
+            $ref: '#/components/schemas/secrets.SecretParameter'
+          type: array
+          uniqueItems: false
+        target_port:
+          description: Port to expose from the container
+          type: integer
+        tools:
+          description: Tools filter
+          items:
+            type: string
+          type: array
+          uniqueItems: false
+        transport:
+          description: Transport configuration
+          type: string
+        volumes:
+          description: Volume mounts
+          items:
+            type: string
+          type: array
+          uniqueItems: false
+      type: object
     v1.updateSecretRequest:
       description: Request to update an existing secret
       properties:
@@ -1310,7 +1373,7 @@ paths:
             application/json:
               schema:
                 items:
-                  $ref: '#/components/schemas/client.Client'
+                  $ref: '#/components/schemas/client.RegisteredClient'
                 type: array
           description: OK
       summary: List all clients
@@ -2109,7 +2172,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/core.Workload'
+                $ref: '#/components/schemas/v1.createRequest'
           description: OK
         "404":
           content:
@@ -2120,6 +2183,45 @@ paths:
       summary: Get workload details
       tags:
       - workloads
+  /api/v1beta/workloads/{name}/edit:
+    post:
+      description: Update an existing workload configuration
+      parameters:
+      - description: Workload name
+        in: path
+        name: name
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/v1.updateRequest'
+        description: Update workload request
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/v1.createWorkloadResponse'
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                type: string
+          description: Bad Request
+        "404":
+          content:
+            application/json:
+              schema:
+                type: string
+          description: Not Found
+      summary: Update workload
+      tags:
+      - workloads
   /api/v1beta/workloads/{name}/export:
     get:
       description: Export a workload's run configuration as JSON
diff --git a/static/api-specs/toolhive-registry-schema.json b/static/api-specs/toolhive-registry-schema.json
index 927860c3..0b6e2a8d 100644
--- a/static/api-specs/toolhive-registry-schema.json
+++ b/static/api-specs/toolhive-registry-schema.json
@@ -534,7 +534,7 @@
           "description": "Categorization tags for search and filtering",
           "items": {
             "type": "string",
-            "pattern": "^[a-z0-9][a-z0-9_-]+[a-z0-9]$"
+            "pattern": "^[a-z0-9][a-z0-9_-]*[a-z0-9]$"
           },
           "minItems": 1,
           "uniqueItems": true