diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index 1de2ef7b64..33b4adc271 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -113,3 +113,4 @@ labels:
   - path: ./lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
   - path: ./lib/all/labels/windows-with-fleet-maintained-apps-installed.yml
   - path: ./lib/all/labels/departments.yml
+  - path: ./lib/all/labels/idp-group-saml-aws-vpn.yml
diff --git a/it-and-security/fleets/workstations.yml b/it-and-security/fleets/workstations.yml
index 1cceddf492..321d276074 100644
--- a/it-and-security/fleets/workstations.yml
+++ b/it-and-security/fleets/workstations.yml
@@ -248,6 +248,12 @@ software:
         - Productivity
   fleet_maintained_apps:
     # macOS apps
+    - slug: aws-vpn-client/darwin # AWS VPN Client for macOS
+      self_service: true
+      labels_include_any:
+        - "IdP group: SAML-aws-vpn"
+      categories:
+        - Utilities
     - slug: google-chrome/darwin # Google Chrome for macOS
       self_service: true
       setup_experience: true
diff --git a/it-and-security/lib/all/labels/idp-group-saml-aws-vpn.yml b/it-and-security/lib/all/labels/idp-group-saml-aws-vpn.yml
new file mode 100644
index 0000000000..faef35742b
--- /dev/null
+++ b/it-and-security/lib/all/labels/idp-group-saml-aws-vpn.yml
@@ -0,0 +1,6 @@
+- name: "IdP group: SAML-aws-vpn"
+  description: Hosts belonging to members of the SAML-aws-vpn IdP group
+  label_membership_type: host_vitals
+  criteria:
+    vital: end_user_idp_group
+    value: SAML-aws-vpn
diff --git a/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml b/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
index b943675bf3..7cf163c2a7 100644
--- a/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
+++ b/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
@@ -53,3 +53,8 @@
   query: SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.firefox';
   label_membership_type: dynamic
   platform: darwin
+- name: Macs with AWS VPN Client installed
+  description: macOS hosts with AWS VPN Client installed
+  query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.amazonaws.acvc.osx';
+  label_membership_type: dynamic
+  platform: darwin
diff --git a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
index 4f8308f531..9b074a5196 100644
--- a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
+++ b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
@@ -87,3 +87,11 @@
   install_software: false
   labels_include_any:
     - Macs with Claude installed
+- name: macOS - AWS VPN Client up to date
+  description: The host may have an outdated version of AWS VPN Client, potentially risking security vulnerabilities or compatibility issues.
+  resolution: "Download the latest version from Self-service or check for updates using AWS VPN Client's built-in update functionality. You can also delete AWS VPN Client if you are no longer using it."
+  type: patch
+  fleet_maintained_app_slug: aws-vpn-client/darwin
+  install_software: false
+  labels_include_any:
+    - Macs with AWS VPN Client installed