diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d3a5695..38eec3d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,7 @@
 name: release
 
 # Publishes to PyPI when a version tag is pushed:
-#   git tag -a v0.2.3 -m "..." && git push origin v0.2.3
+#   git tag -a v0.2.4 -m "..." && git push origin v0.2.4
 #
 # Uses PyPI Trusted Publishing (OIDC): GitHub proves the workflow's identity to
 # PyPI directly, so there is NO API token to store, rotate, or leak. This must be
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1acf65b..d27f5f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,15 @@ All notable changes to this project are documented here. Format follows
 
 ## [Unreleased]
 
+## [0.2.4] — 2026-10-24
+
+**Upgrade from 0.2.3.** No configuration changes. Policies replaced through
+the API are now saved under `${SENTINEL_DATA_DIR}/policies/`: back that
+directory up along with `sentinel.db` (with `deploy/compose.yaml` it is already
+on the data volume). To roll back to 0.2.3: it ignores the saved policies, so
+each tenant returns to its configured policy, and it lists `policy-change`
+runs but cannot replay them.
+
 ### Added
 - Every policy reload is recorded: a `PolicyChanged` span (applied, ignored,
   rejected or failed, with the versions and the SHA-256 of the submitted text)
diff --git a/pyproject.toml b/pyproject.toml
index 749cd03..d2cb1c7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # (`sentinel`, `sentinel-mcp`, `mcp-sentinel` and `sentinely` were all
 # unavailable on PyPI, so the published distribution is `sentinel`.)
 name = "sentinel-prox"
-version = "0.2.3"
+version = "0.2.4"
 description = "Provenance-aware security proxy for AI agents: block prompt-injection actions at the MCP tool boundary."
 requires-python = ">=3.11"
 authors = [{ name = "Pali Krishna Harshith" }]