diff --git a/bin/claudebox b/bin/claudebox
index e2f7575..47c2d3b 100755
--- a/bin/claudebox
+++ b/bin/claudebox
@@ -27,7 +27,7 @@ while [ $# -gt 0 ]; do
 done
 
 die() { echo "claudebox: $*" >&2; exit 1; }
-iname_of() { echo "$remote"claude-"$1"; }
+iname_of() { echo "$remote$1"; }   # instance name = box name; claudebox tags them with user.claudebox=1
 need_name() {
   [ "${#args[@]}" -ge 1 ] && [ -n "${args[0]}" ] || die "usage: claudebox $cmd <box>"
 }
@@ -66,6 +66,7 @@ new() {
     # shellcheck disable=SC2054 # "root,size=60GiB" is a single incus argument
     if [ "$m" = vm ]; then extra+=(--vm --device root,size=60GiB); else extra+=(--config security.nesting=true); fi
     incus launch images:debian/13/cloud "$instance" --profile claude-dev \
+      --config user.claudebox=1 \
       --config cloud-init.user-data="$(cat "$root/cloud-init/user-data.yaml")" \
       "${extra[@]}"
     wait_agent "$instance"
@@ -84,6 +85,6 @@ case "$cmd" in
   down)     need_name; incus stop "$(iname_of "${args[0]}")" ;;
   start)    need_name; incus start "$(iname_of "${args[0]}")" ;;
   rm)       need_name; incus delete -f "$(iname_of "${args[0]}")"; echo "claudebox: removed $(iname_of "${args[0]}")" ;;
-  status)   incus list "${remote}claude-" ;;
+  status)   incus list ${remote:+"$remote"} "user.claudebox=1" ;;
   help|*)   sed -n '2,9p' "$0" | sed 's/^# \{0,1\}//' ;;
 esac
diff --git a/host/teardown-host.sh b/host/teardown-host.sh
index 4350da9..c5a7624 100755
--- a/host/teardown-host.sh
+++ b/host/teardown-host.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Reverse everything host/setup-host.sh created: all claude-* instances, the
+# Reverse everything host/setup-host.sh created: all claudebox instances, the
 # claudenet network + ACL, the claude-dev profile, and the firewall rules.
 # Usage: ./host/teardown-host.sh [--purge-incus]
 #   --purge-incus  also apt-purge Incus itself (skipped if non-claudebox
@@ -9,14 +9,14 @@ set -euo pipefail
 purge=false
 [ "${1:-}" = "--purge-incus" ] && purge=true
 
-echo "This removes ALL claude-* instances (uncommitted work in them is lost),"
+echo "This removes ALL claudebox instances (uncommitted work in them is lost),"
 echo "the claudenet network/ACL/profile, and the claudebox firewall rules."
 $purge && echo "Incus itself will also be uninstalled (--purge-incus)."
 read -rp "Continue? [y/N] " a
 case "$a" in y|Y) ;; *) echo "aborted"; exit 1 ;; esac
 
 # Instances
-for i in $(incus list -f csv -c n | grep '^claude-' || true); do
+for i in $(incus list "user.claudebox=1" -f csv -c n || true); do
   echo "deleting instance $i"
   incus delete -f "$i"
 done