diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index 6d32dce7243..0f23047f64f 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -2246,6 +2246,12 @@ func applyWindowsDesktopConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	}
 	cfg.WindowsDesktop.HostLabels = servicecfg.NewHostLabelRules(hlrs...)
 
+	for _, matcher := range fc.WindowsDesktop.ResourceMatchers {
+		cfg.WindowsDesktop.ResourceMatchers = append(cfg.WindowsDesktop.ResourceMatchers, services.ResourceMatcher{
+			Labels: matcher.Labels,
+		})
+	}
+
 	if fc.WindowsDesktop.Labels != nil {
 		cfg.WindowsDesktop.Labels = maps.Clone(fc.WindowsDesktop.Labels)
 	}
diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go
index 987711d807f..34ea2a60f26 100644
--- a/lib/config/fileconf.go
+++ b/lib/config/fileconf.go
@@ -2399,6 +2399,8 @@ type WindowsDesktopService struct {
 	// A host can match multiple rules and will get a union of all
 	// the matched labels.
 	HostLabels []WindowsHostLabelRule `yaml:"host_labels,omitempty"`
+	// ResourceMatchers match dynamic Windows desktop resources.
+	ResourceMatchers []ResourceMatcher `yaml:"resources,omitempty"`
 }
 
 // Check checks whether the WindowsDesktopService is valid or not
diff --git a/lib/service/desktop.go b/lib/service/desktop.go
index 5ebc52af55a..adc3f19de92 100644
--- a/lib/service/desktop.go
+++ b/lib/service/desktop.go
@@ -236,6 +236,7 @@ func (process *TeleportProcess) initWindowsDesktopServiceRegistered(logger *slog
 		DiscoveryLDAPAttributeLabels: cfg.WindowsDesktop.Discovery.LabelAttributes,
 		Hostname:                     cfg.Hostname,
 		ConnectedProxyGetter:         proxyGetter,
+		ResourceMatchers:             cfg.WindowsDesktop.ResourceMatchers,
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/service/servicecfg/windows.go b/lib/service/servicecfg/windows.go
index d5250c71f7b..988dc16b3e4 100644
--- a/lib/service/servicecfg/windows.go
+++ b/lib/service/servicecfg/windows.go
@@ -24,6 +24,7 @@ import (
 	"regexp"
 
 	"github.com/gravitational/teleport/lib/limiter"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -65,6 +66,8 @@ type WindowsDesktopConfig struct {
 	// HostLabels specifies rules that are used to apply labels to Windows hosts.
 	HostLabels HostLabelRules
 	Labels     map[string]string
+	// ResourceMatchers match dynamic Windows desktop resources.
+	ResourceMatchers []services.ResourceMatcher
 }
 
 // WindowsHost is configuration for single Windows desktop host
diff --git a/lib/srv/desktop/windows_server.go b/lib/srv/desktop/windows_server.go
index 40c19a2ada1..c158d6c1ce0 100644
--- a/lib/srv/desktop/windows_server.go
+++ b/lib/srv/desktop/windows_server.go
@@ -210,6 +210,8 @@ type WindowsServiceConfig struct {
 	// ConnectedProxyGetter gets the proxies teleport is connected to.
 	ConnectedProxyGetter *reversetunnel.ConnectedProxyGetter
 	Labels               map[string]string
+	// ResourceMatchers match dynamic Windows desktop resources.
+	ResourceMatchers []services.ResourceMatcher
 }
 
 // HeartbeatConfig contains the configuration for service heartbeats.