diff --git a/addons/api/addon/generated/models/host-catalog.js b/addons/api/addon/generated/models/host-catalog.js
index 24e976438..007d8587c 100644
--- a/addons/api/addon/generated/models/host-catalog.js
+++ b/addons/api/addon/generated/models/host-catalog.js
@@ -67,18 +67,20 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   })
   disable_credential_rotation;
 
-  // AWS specific
+  // AWS and GCP specific
 
   @attr('string', {
     for: {
       type: 'plugin',
-      name: 'aws',
+      name: ['aws', 'gcp'],
     },
     description:
       'An expression used to filter the workers that have network access to a service that is hosting the external object store.',
   })
   worker_filter;
 
+  // AWS specific
+
   @attr('string', {
     for: {
       type: 'plugin',
diff --git a/addons/api/mirage/factories/host-catalog.js b/addons/api/mirage/factories/host-catalog.js
index d35cc8b07..90a887d5d 100644
--- a/addons/api/mirage/factories/host-catalog.js
+++ b/addons/api/mirage/factories/host-catalog.js
@@ -53,7 +53,8 @@ export default factory.extend({
   worker_filter: function () {
     if (
       this.type === TYPE_HOST_CATALOG_DYNAMIC &&
-      this.plugin?.name === TYPE_HOST_CATALOG_PLUGIN_AWS
+        (this.plugin?.name === TYPE_HOST_CATALOG_PLUGIN_AWS ||
+      this.plugin?.name === TYPE_HOST_CATALOG_PLUGIN_GCP)
     ) {
       return `"${faker.word.noun()}" in "${faker.system.directoryPath()}"`;
     }
diff --git a/addons/api/tests/unit/serializers/application-test.js b/addons/api/tests/unit/serializers/application-test.js
index 810af78a8..0d2ae34f4 100644
--- a/addons/api/tests/unit/serializers/application-test.js
+++ b/addons/api/tests/unit/serializers/application-test.js
@@ -217,6 +217,7 @@ module('Unit | Serializer | application', function (hooks) {
       name: 'GCP plugin',
       description: 'this is a GCP plugin host-catalog',
       type: 'plugin',
+      worker_filter: 'workerfilter',
       attributes: {
         disable_credential_rotation: true,
         project_id: 'project',
diff --git a/addons/api/tests/unit/serializers/host-catalog-test.js b/addons/api/tests/unit/serializers/host-catalog-test.js
index 31065b6a2..e1aa519f0 100644
--- a/addons/api/tests/unit/serializers/host-catalog-test.js
+++ b/addons/api/tests/unit/serializers/host-catalog-test.js
@@ -68,6 +68,7 @@ module('Unit | Serializer | host catalog', function (hooks) {
       name: 'GCP',
       description: 'this is a GCP plugin host-catalog',
       type: 'plugin',
+      worker_filter: 'workerfilter',
       attributes: {
         disable_credential_rotation: true,
         project_id: 'project',
diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml
index 38b7147ba..82ac6af5b 100644
--- a/addons/core/translations/resources/en-us.yaml
+++ b/addons/core/translations/resources/en-us.yaml
@@ -258,7 +258,7 @@ host-catalog:
       help: The unique identifier of private key.
     private_key:
       label: Private Key
-      help: The private key used to obtain a OAuth 2.0 access token.
+      help: The private key used to obtain a OAuth 2.0 access token. Key must be PEM encoded.
 host-set:
   title: Host Set
   title_plural: Host Sets
diff --git a/ui/admin/app/components/form/host-catalog/aws/index.hbs b/ui/admin/app/components/form/host-catalog/aws/index.hbs
index 05f500d2d..5f0601c68 100644
--- a/ui/admin/app/components/form/host-catalog/aws/index.hbs
+++ b/ui/admin/app/components/form/host-catalog/aws/index.hbs
@@ -350,9 +350,8 @@
     </Hds::Form::TextInput::Field>
   {{/if}}
 
-  {{#if (feature-flag 'dynamic-credentials-worker-filter')}}
+  {{#if (feature-flag 'host-catalog-worker-filter')}}
     <Hds::Form::Textarea::Field
-      data-test-dynamic-credential-worker-filter
       name='worker_filter'
       @value={{@model.worker_filter}}
       @isOptional={{true}}
diff --git a/ui/admin/app/components/form/host-catalog/gcp/index.hbs b/ui/admin/app/components/form/host-catalog/gcp/index.hbs
index 962843f6f..5796c997d 100644
--- a/ui/admin/app/components/form/host-catalog/gcp/index.hbs
+++ b/ui/admin/app/components/form/host-catalog/gcp/index.hbs
@@ -15,7 +15,7 @@
     @value={{@model.name}}
     @isInvalid={{@model.errors.name}}
     @isOptional={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'input' (set-from-event @model 'name')}}
     as |F|
   >
@@ -35,7 +35,7 @@
     @value={{@model.description}}
     @isInvalid={{@model.errors.description}}
     @isOptional={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     as |F|
   >
     <F.Label>{{t 'form.description.label'}}</F.Label>
@@ -99,7 +99,7 @@
     <InfoField
       @value={{t 'resources.host-catalog.types.gcp'}}
       @icon='gcp-color'
-      readonly={{true}}
+      disabled={{true}}
       as |F|
     >
       <F.Label>{{t 'titles.provider'}}</F.Label>
@@ -113,7 +113,7 @@
     @value={{@model.project_id}}
     @isInvalid={{@model.errors.project_id}}
     @isRequired={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'input' (set-from-event @model 'project_id')}}
     as |F|
   >
@@ -135,7 +135,7 @@
     @value={{@model.zone}}
     @isInvalid={{@model.errors.zone}}
     @isRequired={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'input' (set-from-event @model 'zone')}}
     as |F|
   >
@@ -155,7 +155,7 @@
     @value={{@model.client_email}}
     @isInvalid={{@model.errors.client_email}}
     @isOptional={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'input' (set-from-event @model 'client_email')}}
     as |F|
   >
@@ -177,7 +177,7 @@
     @value={{@model.target_service_account_id}}
     @isInvalid={{@model.errors.target_service_account_id}}
     @isOptional={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'input' (set-from-event @model 'target_service_account_id')}}
     as |F|
   >
@@ -202,7 +202,7 @@
     @value={{@model.private_key_id}}
     @isInvalid={{@model.errors.private_key_id}}
     @isOptional={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'input' (set-from-event @model 'private_key_id')}}
     as |F|
   >
@@ -224,7 +224,7 @@
     @value={{@model.private_key}}
     @isInvalid={{@model.errors.private_key}}
     @isOptional={{true}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     as |F|
   >
     <F.Label>{{t 'resources.host-catalog.form.private_key.label'}}</F.Label>
@@ -240,10 +240,38 @@
     {{/if}}
   </Hds::Form::Textarea::Field>
 
+  {{#if (feature-flag 'host-catalog-worker-filter')}}
+    <Hds::Form::Textarea::Field
+      name='worker_filter'
+      @value={{@model.worker_filter}}
+      @isOptional={{true}}
+      @isInvalid={{@model.errors.worker_filter}}
+      disabled={{form.disabled}}
+      as |F|
+    >
+      <F.Label>{{t 'form.worker_filter.label'}}</F.Label>
+      <F.HelperText>
+        {{t 'resources.host-catalog.form.worker_filter.help'}}
+        <Hds::Link::Inline @href={{doc-url 'worker.create-tags'}}>
+          {{t 'actions.learn-more'}}
+        </Hds::Link::Inline>
+      </F.HelperText>
+      {{#if @model.errors.worker_filter}}
+        <F.Error as |E|>
+          {{#each @model.errors.worker_filter as |error|}}
+            <E.Message>
+              {{error.message}}
+            </E.Message>
+          {{/each}}
+        </F.Error>
+      {{/if}}
+    </Hds::Form::Textarea::Field>
+  {{/if}}
+
   <Hds::Form::Checkbox::Field
     name='disable_credential_rotation'
     checked={{@model.disable_credential_rotation}}
-    readonly={{form.disabled}}
+    disabled={{form.disabled}}
     {{on 'change' (fn @toggleDisableCredentialRotation @model)}}
     as |F|
   >
diff --git a/ui/admin/config/features.js b/ui/admin/config/features.js
index 5c0908787..37e3a6483 100644
--- a/ui/admin/config/features.js
+++ b/ui/admin/config/features.js
@@ -28,7 +28,7 @@ const baseEdition = {
   'target-network-address': false,
   'vault-worker-filter': false,
   'ldap-auth-methods': false,
-  'dynamic-credentials-worker-filter': false,
+  'host-catalog-worker-filter': false,
 };
 // Editions maps edition keys to their associated featuresets.
 const featureEditions = {};
@@ -44,7 +44,7 @@ featureEditions.enterprise = {
   ...featureEditions.oss,
   'target-worker-filters-v2-ingress': true,
   'vault-worker-filter': true,
-  'dynamic-credentials-worker-filter': true,
+  'host-catalog-worker-filter': true,
 };
 featureEditions.hcp = {
   ...featureEditions.enterprise,
diff --git a/ui/admin/tests/acceptance/host-catalogs/create-test.js b/ui/admin/tests/acceptance/host-catalogs/create-test.js
index baaa3afe9..75a93c8c5 100644
--- a/ui/admin/tests/acceptance/host-catalogs/create-test.js
+++ b/ui/admin/tests/acceptance/host-catalogs/create-test.js
@@ -26,6 +26,7 @@ module('Acceptance | host-catalogs | create', function (hooks) {
   const CANCEL_BUTTON_SELECTOR = '.rose-form-actions [type="button"]';
   const ALERT_TEXT_SELECTOR =
     '[data-test-toast-notification] .hds-alert__description';
+  const WORKER_FILTER_INPUT_SELECTOR = '[name=worker_filter]';
 
   const instances = {
     scopes: {
@@ -177,7 +178,7 @@ module('Acceptance | host-catalogs | create', function (hooks) {
         'host-catalogs'
       ].includes('create'),
     );
-    assert.dom(`[href="${urls.newHostCatalog}"]`).exists();
+    assert.dom(`[href="${urls.newHostCatalog}"]`).isVisible();
   });
 
   test('Users cannot navigate to new static host catalogs route without proper authorization', async function (assert) {
@@ -189,7 +190,7 @@ module('Acceptance | host-catalogs | create', function (hooks) {
         'host-catalogs'
       ].includes('create'),
     );
-    assert.dom(`[href="${urls.newStaticHostCatalog}"]`).doesNotExist();
+    assert.dom(`[href="${urls.newStaticHostCatalog}"]`).isNotVisible();
   });
 
   test('saving a new static host catalog with invalid fields displays error messages', async function (assert) {
@@ -218,15 +219,26 @@ module('Acceptance | host-catalogs | create', function (hooks) {
     assert.dom('[data-test-error-message-name]').hasText('Name is required.');
   });
 
-  test('users should not see worker filter field in community edition', async function (assert) {
+  test('users should not see worker filter field in community edition when AWS host catalog is selected', async function (assert) {
     await visit(urls.newAWSDynamicHostCatalog);
-    assert.dom('[data-test-dynamic-credential-worker-filter]').doesNotExist();
+    assert.dom(WORKER_FILTER_INPUT_SELECTOR).isNotVisible();
   });
 
-  test('users should see worker filter field in enterprise edition', async function (assert) {
-    featuresService.enable('dynamic-credentials-worker-filter');
+  test('users should not see worker filter field in community edition when GCP host catalog is selected', async function (assert) {
+    await visit(urls.newGCPDynamicHostCatalog);
+    assert.dom(WORKER_FILTER_INPUT_SELECTOR).isNotVisible();
+  });
+
+  test('users should see worker filter field in enterprise edition when AWS host catalog is selected', async function (assert) {
+    featuresService.enable('host-catalog-worker-filter');
     await visit(urls.newAWSDynamicHostCatalog);
-    assert.dom('[data-test-dynamic-credential-worker-filter]').exists();
+    assert.dom(WORKER_FILTER_INPUT_SELECTOR).isVisible();
+  });
+
+  test('users should see worker filter field in enterprise edition when GCP host catalog is selected', async function (assert) {
+    featuresService.enable('host-catalog-worker-filter');
+    await visit(urls.newAWSDynamicHostCatalog);
+    assert.dom(WORKER_FILTER_INPUT_SELECTOR).isVisible();
   });
 
   test('users cannot directly navigate to new host catalog route without proper authorization', async function (assert) {