diff --git a/bastion/completions/lab.fish b/bastion/completions/lab.fish
deleted file mode 100644
index 90bad01..0000000
--- a/bastion/completions/lab.fish
+++ /dev/null
@@ -1,91 +0,0 @@
-# lab fish completions -- auto-generated by scripts/generate-completions.ts
-# DO NOT EDIT MANUALLY -- run: pnpm completions:generate
-
-complete -c lab -e
-complete -c lab -f
-
-# Global options
-complete -c lab -s v -l version -d 'Show version'
-complete -c lab -s h -l help -d 'Show help'
-
-# Helper: test if a subcommand chain is active
-function __lab_using_cmd
-    set -l tokens (commandline -opc)
-    set -l expected $argv
-    set -l depth (count $expected)
-    set -l found 0
-    set -l i 1
-    for tok in $tokens[2..]
-        if string match -q -- "-*" $tok
-            continue
-        end
-        set i (math $i + 1)
-        set -l idx (math $i - 1)
-        if test $idx -le $depth
-            if test "$tok" != "$expected[$idx]"
-                return 1
-            end
-            set found (math $found + 1)
-        else
-            return 1
-        end
-    end
-    test $found -eq $depth
-end
-
-# Top-level commands
-complete -c lab -n "not __fish_seen_subcommand_from init provision" -a init -d 'Initialise infrastructure components'
-complete -c lab -n "not __fish_seen_subcommand_from init provision" -a provision -d 'Machine provisioning operations'
-
-# init subcommands
-complete -c lab -n "__lab_using_cmd init" -a bastion -d 'Bastion PXE server management'
-
-# init bastion subcommands
-complete -c lab -n "__lab_using_cmd init bastion" -a standalone -d 'Standalone bastion server lifecycle'
-
-# init bastion standalone subcommands
-complete -c lab -n "__lab_using_cmd init bastion standalone" -a start -d 'Start the bastion server (HTTP + dnsmasq PXE)'
-complete -c lab -n "__lab_using_cmd init bastion standalone" -a stop -d 'Stop a running bastion server'
-complete -c lab -n "__lab_using_cmd init bastion standalone" -a status -d 'Show bastion server status'
-
-# init bastion standalone start options
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l port -d 'HTTP port' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l dir -d 'Bastion data directory' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l domain -d 'Internal domain for hostnames' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l dhcp-mode -d 'DHCP mode: proxy or full' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l fedora -d 'Fedora version' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l arch -d 'Architecture' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l timezone -d 'Timezone' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l locale -d 'Locale' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l skip-dnsmasq -d 'Skip starting dnsmasq (for testing)'
-complete -c lab -n "__lab_using_cmd init bastion standalone start" -l skip-artifacts -d 'Skip downloading boot artifacts (for testing)'
-
-# init bastion standalone stop options
-complete -c lab -n "__lab_using_cmd init bastion standalone stop" -l dir -d 'Bastion data directory' -x
-
-# init bastion standalone status options
-complete -c lab -n "__lab_using_cmd init bastion standalone status" -l dir -d 'Bastion data directory' -x
-complete -c lab -n "__lab_using_cmd init bastion standalone status" -l port -d 'Bastion HTTP port' -x
-
-# provision subcommands
-complete -c lab -n "__lab_using_cmd provision" -a list -d 'List all known machines'
-complete -c lab -n "__lab_using_cmd provision" -a install -d 'Queue a discovered machine for Fedora installation'
-complete -c lab -n "__lab_using_cmd provision" -a reprovision -d 'Queue install + SSH reboot into PXE for reprovision'
-complete -c lab -n "__lab_using_cmd provision" -a forget -d 'Remove a machine from bastion state'
-
-# provision list options
-complete -c lab -n "__lab_using_cmd provision list" -l port -d 'Bastion HTTP port' -x
-
-# provision install options
-complete -c lab -n "__lab_using_cmd provision install" -l role -d 'Machine role: worker or infra' -x
-complete -c lab -n "__lab_using_cmd provision install" -l disk -d 'Target disk device (auto-detect if omitted)' -x
-complete -c lab -n "__lab_using_cmd provision install" -l port -d 'Bastion HTTP port' -x
-
-# provision reprovision options
-complete -c lab -n "__lab_using_cmd provision reprovision" -l role -d 'Machine role: worker or infra' -x
-complete -c lab -n "__lab_using_cmd provision reprovision" -l disk -d 'Target disk device (auto-detect if omitted)' -x
-complete -c lab -n "__lab_using_cmd provision reprovision" -l port -d 'Bastion HTTP port' -x
-
-# provision forget options
-complete -c lab -n "__lab_using_cmd provision forget" -l port -d 'Bastion HTTP port' -x
-
diff --git a/bastion/completions/lab.bash b/bastion/completions/labctl.bash
similarity index 94%
rename from bastion/completions/lab.bash
rename to bastion/completions/labctl.bash
index a334edb..49b8f68 100644
--- a/bastion/completions/lab.bash
+++ b/bastion/completions/labctl.bash
@@ -1,7 +1,7 @@
-# lab bash completions -- auto-generated by scripts/generate-completions.ts
+# labctl bash completions -- auto-generated by scripts/generate-completions.ts
 # DO NOT EDIT MANUALLY -- run: pnpm completions:generate
 
-_lab() {
+_labctl() {
   local cur prev words cword
   _init_completion || return
 
@@ -64,4 +64,4 @@ _lab() {
   esac
 }
 
-complete -F _lab lab
+complete -F _labctl labctl
diff --git a/bastion/completions/labctl.fish b/bastion/completions/labctl.fish
new file mode 100644
index 0000000..074c974
--- /dev/null
+++ b/bastion/completions/labctl.fish
@@ -0,0 +1,91 @@
+# labctl fish completions -- auto-generated by scripts/generate-completions.ts
+# DO NOT EDIT MANUALLY -- run: pnpm completions:generate
+
+complete -c labctl -e
+complete -c labctl -f
+
+# Global options
+complete -c labctl -s v -l version -d 'Show version'
+complete -c labctl -s h -l help -d 'Show help'
+
+# Helper: test if a subcommand chain is active
+function __labctl_using_cmd
+    set -l tokens (commandline -opc)
+    set -l expected $argv
+    set -l depth (count $expected)
+    set -l found 0
+    set -l i 1
+    for tok in $tokens[2..]
+        if string match -q -- "-*" $tok
+            continue
+        end
+        set i (math $i + 1)
+        set -l idx (math $i - 1)
+        if test $idx -le $depth
+            if test "$tok" != "$expected[$idx]"
+                return 1
+            end
+            set found (math $found + 1)
+        else
+            return 1
+        end
+    end
+    test $found -eq $depth
+end
+
+# Top-level commands
+complete -c labctl -n "not __fish_seen_subcommand_from init provision" -a init -d 'Initialise infrastructure components'
+complete -c labctl -n "not __fish_seen_subcommand_from init provision" -a provision -d 'Machine provisioning operations'
+
+# init subcommands
+complete -c labctl -n "__labctl_using_cmd init" -a bastion -d 'Bastion PXE server management'
+
+# init bastion subcommands
+complete -c labctl -n "__labctl_using_cmd init bastion" -a standalone -d 'Standalone bastion server lifecycle'
+
+# init bastion standalone subcommands
+complete -c labctl -n "__labctl_using_cmd init bastion standalone" -a start -d 'Start the bastion server (HTTP + dnsmasq PXE)'
+complete -c labctl -n "__labctl_using_cmd init bastion standalone" -a stop -d 'Stop a running bastion server'
+complete -c labctl -n "__labctl_using_cmd init bastion standalone" -a status -d 'Show bastion server status'
+
+# init bastion standalone start options
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l port -d 'HTTP port' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l dir -d 'Bastion data directory' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l domain -d 'Internal domain for hostnames' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l dhcp-mode -d 'DHCP mode: proxy or full' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l fedora -d 'Fedora version' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l arch -d 'Architecture' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l timezone -d 'Timezone' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l locale -d 'Locale' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l skip-dnsmasq -d 'Skip starting dnsmasq (for testing)'
+complete -c labctl -n "__labctl_using_cmd init bastion standalone start" -l skip-artifacts -d 'Skip downloading boot artifacts (for testing)'
+
+# init bastion standalone stop options
+complete -c labctl -n "__labctl_using_cmd init bastion standalone stop" -l dir -d 'Bastion data directory' -x
+
+# init bastion standalone status options
+complete -c labctl -n "__labctl_using_cmd init bastion standalone status" -l dir -d 'Bastion data directory' -x
+complete -c labctl -n "__labctl_using_cmd init bastion standalone status" -l port -d 'Bastion HTTP port' -x
+
+# provision subcommands
+complete -c labctl -n "__labctl_using_cmd provision" -a list -d 'List all known machines'
+complete -c labctl -n "__labctl_using_cmd provision" -a install -d 'Queue a discovered machine for Fedora installation'
+complete -c labctl -n "__labctl_using_cmd provision" -a reprovision -d 'Queue install + SSH reboot into PXE for reprovision'
+complete -c labctl -n "__labctl_using_cmd provision" -a forget -d 'Remove a machine from bastion state'
+
+# provision list options
+complete -c labctl -n "__labctl_using_cmd provision list" -l port -d 'Bastion HTTP port' -x
+
+# provision install options
+complete -c labctl -n "__labctl_using_cmd provision install" -l role -d 'Machine role: worker or infra' -x
+complete -c labctl -n "__labctl_using_cmd provision install" -l disk -d 'Target disk device (auto-detect if omitted)' -x
+complete -c labctl -n "__labctl_using_cmd provision install" -l port -d 'Bastion HTTP port' -x
+
+# provision reprovision options
+complete -c labctl -n "__labctl_using_cmd provision reprovision" -l role -d 'Machine role: worker or infra' -x
+complete -c labctl -n "__labctl_using_cmd provision reprovision" -l disk -d 'Target disk device (auto-detect if omitted)' -x
+complete -c labctl -n "__labctl_using_cmd provision reprovision" -l port -d 'Bastion HTTP port' -x
+
+# provision forget options
+complete -c labctl -n "__labctl_using_cmd provision forget" -l port -d 'Bastion HTTP port' -x
+
diff --git a/bastion/nfpm.yaml b/bastion/nfpm.yaml
index ddcd3e4..4c9dd03 100644
--- a/bastion/nfpm.yaml
+++ b/bastion/nfpm.yaml
@@ -1,4 +1,4 @@
-name: lab
+name: labctl
 arch: amd64
 version: 0.1.0
 release: "1"
@@ -6,15 +6,15 @@ maintainer: michal
 description: Lab infrastructure CLI for bare-metal provisioning
 license: MIT
 contents:
-  - src: ./dist/lab
-    dst: /usr/bin/lab
+  - src: ./dist/labctl
+    dst: /usr/bin/labctl
     file_info:
       mode: 0755
-  - src: ./completions/lab.bash
-    dst: /usr/share/bash-completion/completions/lab
+  - src: ./completions/labctl.bash
+    dst: /usr/share/bash-completion/completions/labctl
     file_info:
       mode: 0644
-  - src: ./completions/lab.fish
-    dst: /usr/share/fish/vendor_completions.d/lab.fish
+  - src: ./completions/labctl.fish
+    dst: /usr/share/fish/vendor_completions.d/labctl.fish
     file_info:
       mode: 0644
diff --git a/bastion/scripts/build-rpm.sh b/bastion/scripts/build-rpm.sh
index 8b14bd7..70cee22 100755
--- a/bastion/scripts/build-rpm.sh
+++ b/bastion/scripts/build-rpm.sh
@@ -22,7 +22,7 @@ usage() {
   cat <<EOF
 Usage: $(basename "$0") [OPTIONS]
 
-Build lab binary and produce RPM/DEB packages.
+Build labctl binary and produce RPM/DEB packages.
 
 Options:
   --arch ARCH    Target architecture: x86_64 or arm64 (default: host arch)
@@ -106,7 +106,7 @@ build_arch() {
 
   bun_target="$(bun_target_for "$arch")"
   nfpm_arch="$(nfpm_arch_for "$arch")"
-  binary_name="dist/lab-${arch}"
+  binary_name="dist/labctl-${arch}"
 
   echo ""
   echo "==> Bundling standalone binary for ${arch}..."
@@ -117,7 +117,7 @@ build_arch() {
   local tmpconfig
   tmpconfig="$(mktemp /tmp/nfpm-XXXXXX.yaml)"
   sed -e "s|^arch:.*|arch: ${nfpm_arch}|" \
-      -e "s|src: ./dist/lab$|src: ./${binary_name}|" \
+      -e "s|src: ./dist/labctl$|src: ./${binary_name}|" \
       nfpm.yaml > "$tmpconfig"
 
   nfpm pkg --config "$tmpconfig" --packager rpm --target dist/
@@ -125,7 +125,7 @@ build_arch() {
 
   local rpm_arch
   rpm_arch="$(rpm_arch_for "$arch")"
-  RPM_FILE=$(ls dist/lab-*.${rpm_arch}.rpm 2>/dev/null | head -1)
+  RPM_FILE=$(ls dist/labctl-*.${rpm_arch}.rpm 2>/dev/null | head -1)
   echo "==> Built: $RPM_FILE"
   echo "    Size: $(du -h "$RPM_FILE" | cut -f1)"
 
@@ -136,13 +136,13 @@ build_arch() {
 
   tmpconfig="$(mktemp /tmp/nfpm-XXXXXX.yaml)"
   sed -e "s|^arch:.*|arch: ${nfpm_arch}|" \
-      -e "s|src: ./dist/lab$|src: ./${binary_name}|" \
+      -e "s|src: ./dist/labctl$|src: ./${binary_name}|" \
       nfpm.yaml > "$tmpconfig"
 
   nfpm pkg --config "$tmpconfig" --packager deb --target dist/
   rm -f "$tmpconfig"
 
-  DEB_FILE=$(ls dist/lab_*_${deb_arch}.deb 2>/dev/null | head -1)
+  DEB_FILE=$(ls dist/labctl_*_${deb_arch}.deb 2>/dev/null | head -1)
   echo "==> Built: $DEB_FILE"
   echo "    Size: $(du -h "$DEB_FILE" | cut -f1)"
 }
@@ -162,7 +162,7 @@ echo "==> Generating shell completions..."
 pnpm completions:generate
 
 mkdir -p dist
-rm -f dist/lab dist/lab-x86_64 dist/lab-arm64 dist/lab-*.rpm dist/lab*.deb
+rm -f dist/labctl dist/labctl-x86_64 dist/labctl-arm64 dist/labctl-*.rpm dist/labctl*.deb
 
 if [ "$BUILD_ALL" = true ]; then
   build_arch "x86_64"
@@ -177,4 +177,4 @@ fi
 
 echo ""
 echo "==> Build complete. Artifacts in dist/:"
-ls -lh dist/lab* 2>/dev/null || echo "  (none)"
+ls -lh dist/labctl* 2>/dev/null || echo "  (none)"
diff --git a/bastion/scripts/generate-completions.ts b/bastion/scripts/generate-completions.ts
index d095ea1..b10e588 100644
--- a/bastion/scripts/generate-completions.ts
+++ b/bastion/scripts/generate-completions.ts
@@ -330,29 +330,29 @@ async function main(): Promise<void> {
   const bashContent = generateBash(tree);
 
   const completionsDir = join(ROOT, 'completions');
-  const fishPath = join(completionsDir, 'lab.fish');
-  const bashPath = join(completionsDir, 'lab.bash');
+  const fishPath = join(completionsDir, 'labctl.fish');
+  const bashPath = join(completionsDir, 'labctl.bash');
 
   if (mode === '--check') {
     let stale = false;
     try {
       const currentFish = readFileSync(fishPath, 'utf-8');
       if (currentFish !== fishContent) {
-        console.error('completions/lab.fish is stale');
+        console.error('completions/labctl.fish is stale');
         stale = true;
       }
     } catch {
-      console.error('completions/lab.fish does not exist');
+      console.error('completions/labctl.fish does not exist');
       stale = true;
     }
     try {
       const currentBash = readFileSync(bashPath, 'utf-8');
       if (currentBash !== bashContent) {
-        console.error('completions/lab.bash is stale');
+        console.error('completions/labctl.bash is stale');
         stale = true;
       }
     } catch {
-      console.error('completions/lab.bash does not exist');
+      console.error('completions/labctl.bash does not exist');
       stale = true;
     }
     if (stale) {
@@ -373,9 +373,9 @@ async function main(): Promise<void> {
   }
 
   // Default: print to stdout
-  console.log('=== completions/lab.fish ===');
+  console.log('=== completions/labctl.fish ===');
   console.log(fishContent);
-  console.log('=== completions/lab.bash ===');
+  console.log('=== completions/labctl.bash ===');
   console.log(bashContent);
 }
 
diff --git a/bastion/scripts/publish-deb.sh b/bastion/scripts/publish-deb.sh
index 56908b3..7929ec0 100755
--- a/bastion/scripts/publish-deb.sh
+++ b/bastion/scripts/publish-deb.sh
@@ -21,7 +21,7 @@ if [ -z "$GITEA_TOKEN" ]; then
   exit 1
 fi
 
-DEB_FILE=$(ls dist/lab*.deb 2>/dev/null | head -1)
+DEB_FILE=$(ls dist/labctl*.deb 2>/dev/null | head -1)
 if [ -z "$DEB_FILE" ]; then
   echo "Error: No DEB found in dist/. Run scripts/build-rpm.sh first."
   exit 1
@@ -63,10 +63,10 @@ echo "==> Published successfully!"
 
 # Ensure package is linked to the repository
 source "$SCRIPT_DIR/link-package.sh"
-link_package "debian" "lab"
+link_package "debian" "labctl"
 
 echo ""
 echo "Install with:"
-echo "  echo \"deb ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian trixie main\" | sudo tee /etc/apt/sources.list.d/lab.list"
-echo "  curl -fsSL ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian/repository.key | sudo gpg --dearmor -o /etc/apt/keyrings/lab.gpg"
-echo "  sudo apt update && sudo apt install lab"
+echo "  echo \"deb ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian trixie main\" | sudo tee /etc/apt/sources.list.d/labctl.list"
+echo "  curl -fsSL ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian/repository.key | sudo gpg --dearmor -o /etc/apt/keyrings/labctl.gpg"
+echo "  sudo apt update && sudo apt install labctl"
diff --git a/bastion/scripts/publish-rpm.sh b/bastion/scripts/publish-rpm.sh
index 8c2103c..1a72e63 100755
--- a/bastion/scripts/publish-rpm.sh
+++ b/bastion/scripts/publish-rpm.sh
@@ -21,7 +21,7 @@ if [ -z "$GITEA_TOKEN" ]; then
   exit 1
 fi
 
-RPM_FILE=$(ls dist/lab-*.rpm 2>/dev/null | head -1)
+RPM_FILE=$(ls dist/labctl-*.rpm 2>/dev/null | head -1)
 if [ -z "$RPM_FILE" ]; then
   echo "Error: No RPM found in dist/. Run scripts/build-rpm.sh first."
   exit 1
@@ -35,13 +35,13 @@ echo "==> Publishing $RPM_FILE (version $RPM_VERSION) to ${GITEA_URL}..."
 # Check if version already exists and delete it first
 EXISTING=$(curl -s -o /dev/null -w "%{http_code}" \
   -H "Authorization: token ${GITEA_TOKEN}" \
-  "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/lab/${RPM_VERSION}")
+  "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/labctl/${RPM_VERSION}")
 
 if [ "$EXISTING" = "200" ]; then
   echo "==> Version $RPM_VERSION already exists, replacing..."
   curl -s -o /dev/null -X DELETE \
     -H "Authorization: token ${GITEA_TOKEN}" \
-    "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/lab/${RPM_VERSION}"
+    "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/labctl/${RPM_VERSION}"
 fi
 
 # Upload
@@ -55,8 +55,8 @@ echo "==> Published successfully!"
 
 # Ensure package is linked to the repository
 source "$SCRIPT_DIR/link-package.sh"
-link_package "rpm" "lab"
+link_package "rpm" "labctl"
 
 echo ""
 echo "Install with:"
-echo "  sudo dnf install lab  # if repo already configured"
+echo "  sudo dnf install labctl  # if repo already configured"
diff --git a/bastion/scripts/release.sh b/bastion/scripts/release.sh
index f2ae711..2bbee68 100755
--- a/bastion/scripts/release.sh
+++ b/bastion/scripts/release.sh
@@ -36,12 +36,12 @@ echo ""
 # 5. Install locally (Fedora/RHEL only)
 if [ -f /etc/fedora-release ] || [ -f /etc/redhat-release ]; then
   echo "==> Installing locally..."
-  RPM_FILE=$(ls dist/lab-*.rpm 2>/dev/null | head -1)
+  RPM_FILE=$(ls dist/labctl-*.rpm 2>/dev/null | head -1)
   if [ -n "$RPM_FILE" ]; then
     sudo rpm -U --force "$RPM_FILE"
     echo ""
     echo "==> Installed:"
-    lab --version || echo "(lab binary installed)"
+    labctl --version || echo "(labctl binary installed)"
   else
     echo "==> WARNING: No RPM found in dist/, skipping local install."
   fi
@@ -61,12 +61,12 @@ echo "=== Done! ==="
 echo ""
 echo "RPM install:"
 echo "  sudo dnf config-manager --add-repo ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/rpm.repo"
-echo "  sudo dnf install lab"
+echo "  sudo dnf install labctl"
 echo ""
 echo "DEB install (Debian/Ubuntu):"
-echo "  echo \"deb ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian trixie main\" | sudo tee /etc/apt/sources.list.d/lab.list"
-echo "  curl -fsSL ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian/repository.key | sudo gpg --dearmor -o /etc/apt/keyrings/lab.gpg"
-echo "  sudo apt update && sudo apt install lab"
+echo "  echo \"deb ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian trixie main\" | sudo tee /etc/apt/sources.list.d/labctl.list"
+echo "  curl -fsSL ${GITEA_PUBLIC_URL}/api/packages/${GITEA_OWNER}/debian/repository.key | sudo gpg --dearmor -o /etc/apt/keyrings/labctl.gpg"
+echo "  sudo apt update && sudo apt install labctl"
 echo ""
 echo "Docker image:"
 echo "  podman pull ${REGISTRY}/michal/lab-bastion:${VERSION}"
diff --git a/bastion/src/bastion/src/main.ts b/bastion/src/bastion/src/main.ts
index d4021fc..2f7b1b0 100644
--- a/bastion/src/bastion/src/main.ts
+++ b/bastion/src/bastion/src/main.ts
@@ -94,7 +94,7 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
   // PID file management: kill old instance if running
   // Bastion needs root for dnsmasq (DHCP port 67)
   if (!config.skipDnsmasq && process.getuid?.() !== 0) {
-    logger.error("Must run as root (dnsmasq needs DHCP/TFTP ports). Use: sudo lab init bastion standalone start");
+    logger.error("Must run as root (dnsmasq needs DHCP/TFTP ports). Use: sudo labctl init bastion standalone start");
     process.exit(1);
   }
 
@@ -262,8 +262,8 @@ function printBanner(config: BastionConfig): void {
   console.log("  \x1b[33mIt will be inventoried and rebooted automatically.\x1b[0m");
   console.log("");
   console.log("  Commands (from another terminal):");
-  console.log("    \x1b[1mlab list\x1b[0m                           -- show machines");
-  console.log("    \x1b[1mlab install <mac> <hostname>\x1b[0m       -- queue install");
+  console.log("    \x1b[1mlabctl provision list\x1b[0m               -- show machines");
+  console.log("    \x1b[1mlabctl provision install <mac> <hostname>\x1b[0m -- queue install");
   console.log("");
   console.log("  Press \x1b[1mCtrl-C\x1b[0m to stop.");
   console.log("");
diff --git a/bastion/src/cli/package.json b/bastion/src/cli/package.json
index fbee854..52b7b32 100644
--- a/bastion/src/cli/package.json
+++ b/bastion/src/cli/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "bin": {
-    "lab": "./dist/index.js"
+    "labctl": "./dist/index.js"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
diff --git a/bastion/src/cli/src/commands/serve.ts b/bastion/src/cli/src/commands/serve.ts
index e960ea8..6e34175 100644
--- a/bastion/src/cli/src/commands/serve.ts
+++ b/bastion/src/cli/src/commands/serve.ts
@@ -57,7 +57,7 @@ export function registerStartCommand(parent: Command): void {
       // Add --foreground flag
       args.push("--foreground");
 
-      const child: ChildProcess = spawn(process.argv[0] ?? "lab", args, {
+      const child: ChildProcess = spawn(process.argv[0] ?? "labctl", args, {
         detached: true,
         stdio: ["ignore", "pipe", "pipe"],
       });
diff --git a/bastion/src/cli/src/index.ts b/bastion/src/cli/src/index.ts
index a276138..8f84bf2 100644
--- a/bastion/src/cli/src/index.ts
+++ b/bastion/src/cli/src/index.ts
@@ -19,7 +19,7 @@ export function createProgram(): Command {
   const program = new Command();
 
   program
-    .name("lab")
+    .name("labctl")
     .description("Lab PXE Bastion -- discover-first bare-metal provisioning")
     .version(APP_VERSION);
 
diff --git a/bastion/src/shared/src/constants/index.ts b/bastion/src/shared/src/constants/index.ts
index fde2bb2..73496b8 100644
--- a/bastion/src/shared/src/constants/index.ts
+++ b/bastion/src/shared/src/constants/index.ts
@@ -1,4 +1,4 @@
 // Application-wide constants.
 
-export const APP_NAME = "lab";
+export const APP_NAME = "labctl";
 export const APP_VERSION = "0.1.0";