diff --git a/CHANGELOG.md b/CHANGELOG.md
index a08640a..35ec618 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,39 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.24.0] - 2026-09-28
+
+### Added
+- Box Now locker picker support for the newly-extracted checkout module: `CheckoutController::
+  boxNowLockers()`/`selectBoxNowLocker()`, the `bbk-box-now-locker-controller.js` Stimulus
+  controller, its picker markup in `shipping-options.blade.php`, and its styles in
+  `checkout.css` — the routes and translation seeder for this already existed from the previous
+  extraction, but the controller methods and JS/CSS themselves hadn't been carried over, leaving
+  the `checkout.box-now.lockers` route throwing `BadMethodCallException`.
+- `ProductIndexer`'s `recommendations` entries now include `variant_id` and `has_custom_fields` —
+  previously only `{id, name, price, image}`, which left a recommended product's card with
+  neither an "Add to cart" nor a "Personalize" button, since a storefront card needs one of
+  those two fields to decide which to show at all.
+- A real `package.json` for this package's JS (Stimulus controllers) and CSS, installed by a
+  consuming app as a normal npm dependency (`file:../boboko-core` in local dev, a tagged git
+  install — `git+https://...#semver:0.x`, mirroring `composer.json`'s own `0.*` constraint — in
+  prod) so `npm install`/`npm update @boboko/core` resolves this package's own JS dependencies
+  (`leaflet`, `@hotwired/stimulus`) transitively, the same way `composer update boboko/*` already
+  does for PHP. A consuming app registers `boboko()` from the new `vite-plugin.js` export in its
+  own `vite.config.js`, which encapsulates every quirk of that installation method (symlink
+  resolution, HMR watching, dependency pre-bundling) so the consumer's own config stays a
+  one-line plugin registration. Consumers import this package's JS from one stable entry point,
+  `resources/js/index.js` (`@boboko/core`'s package root export), rather than reaching into a
+  specific module's internal file layout directly — see this package's `CONTRIBUTE.md` and
+  `docs/modules.md`.
+
+### Fixed
+- `Catalog\Recommendations\RandomRule` resolved products via the base `Lunar\Models\Product`
+  directly instead of through `ModelManifest`, silently losing `custom_fields` (which only the
+  registered `Modules\Core\Catalog\Models\Product` subclass can read) for any recommendation it
+  produced. `SameCategoryRule` was already correct, since `Collection::products()` resolves via
+  Lunar's own `Product::modelClass()`.
+
 ## [0.23.0] - 2026-09-25
 
 ### Added
diff --git a/composer.json b/composer.json
index 53e5eb6..e5b5518 100644
--- a/composer.json
+++ b/composer.json
@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"
diff --git a/package.json b/package.json
index d351574..48cecae 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@boboko/core",
-    "version": "0.23.0",
+    "version": "0.24.0",
     "private": true,
     "type": "module",
     "description": "Portable Stimulus controllers and styles for boboko-core's cart + checkout module. Installed as a real npm dependency (file:../boboko-core in dev, a tagged git install in prod) so a consuming app's `npm install` resolves this package's own dependencies (leaflet, @hotwired/stimulus) transitively, the same way `composer update boboko/*` does for PHP. See CONTRIBUTE.md's \"JS/CSS: a real npm package\" section.",