diff --git a/gh-repositories.tf b/gh-repositories.tf
index 0e788a2..ed1cec8 100644
--- a/gh-repositories.tf
+++ b/gh-repositories.tf
@@ -13,6 +13,12 @@ resource "github_repository" "repositories" {
   delete_branch_on_merge      = true
   squash_merge_commit_title   = "PR_TITLE"
   squash_merge_commit_message = "PR_BODY"
+  # Topics are declared in main.tf (local.topics_by_repository) and managed
+  # for active repositories only (local.active_github_repositories);
+  # archived repositories are skipped and their existing GitHub topics stay
+  # unmanaged. A missing entry for an active repository fails the plan; use
+  # an explicit empty list for a repository that should carry no topics.
+  topics = contains(local.active_github_repositories, each.key) ? local.topics_by_repository[each.key] : null
   lifecycle {
     ignore_changes = [
       description,
diff --git a/main.tf b/main.tf
index 4b2aa60..c54e5c6 100644
--- a/main.tf
+++ b/main.tf
@@ -31,6 +31,31 @@ locals {
   private_github_repositories = toset([
     "agent-knowledge"
   ])
+  # Topics are managed for active repositories only
+  # (local.active_github_repositories). Archived repositories are skipped
+  # entirely (see gh-repositories.tf) and their existing GitHub topics stay
+  # unmanaged, so they carry no entry here. The lookup for active
+  # repositories is direct, so adding an active repository without a topics
+  # entry fails the plan; a repository intentionally without topics declares
+  # an explicit empty list. Values audited against live GitHub repository
+  # topics on 2026-09-02.
+  topics_by_repository = {
+    ".github"                  = ["community-health", "github", "org-profile"]
+    "agent-knowledge"          = ["agents", "documentation", "knowledge-base", "opencode"]
+    "cflan"                    = ["cloudflare", "dns", "networking", "networkmanager", "python"]
+    "charts"                   = ["ghcr", "gitops", "helm", "helm-charts", "oci"]
+    "images"                   = ["buildah", "containerfiles", "custom-runners", "github-actions", "opentofu"]
+    "kustomize-cluster"        = ["app-of-apps", "argocd", "gitops", "k3s", "ksops", "kustomize", "sops"]
+    "shared-workflows"         = ["github-actions", "github-workflows", "opentofu", "reusable-workflows", "shared-workflows"]
+    "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"]
+    "tfroot-aws"               = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"]
+    "tfroot-cloudflare"        = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"]
+    "tfroot-gcp"               = ["gcp", "gcs-backend", "kms", "opentofu", "sops", "tfstate", "workload-identity-federation"]
+    "tfroot-github"            = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"]
+    "tfroot-libvirt"           = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"]
+    "tfroot-namecheap"         = ["cloudflare", "dns", "domains", "namecheap", "opentofu"]
+    "www"                      = ["cloudflare", "css", "html", "pwa", "s3", "static-site"]
+  }
   relaxed_branch_protection_github_repositories = toset([
     "agent-knowledge"
   ])