diff --git a/CHANGELOG.md b/CHANGELOG.md
index f22bdda..a9bd1cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.0] - 2026-01-18
+
+### Changed
+- **CORE VERSION**: Now downloads `capiscio-core` v2.4.0
+
+### Added
+- **PoP Protocol (RFC-003)**: Badge issuance via Proof of Possession for IAL-1 verification
+- **Staleness Fail-Closed**: Badges now fail validation when stale (security hardening)
+- **MCP Service**: Server identity operations support
+
 ## [2.3.1] - 2025-01-14
 
 ### Changed
diff --git a/package.json b/package.json
index e78a6bb..00c82a2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "validate-a2a",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "GitHub Action to validate A2A protocol agent cards with three-dimensional scoring",
   "main": "dist/index.js",
   "scripts": {
diff --git a/src/index.ts b/src/index.ts
index b4fcade..05575b3 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -5,7 +5,7 @@ import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
 
-const CAPISCIO_VERSION = '2.2.0';
+const CAPISCIO_VERSION = '2.4.0';
 
 interface ValidationResult {
   success: boolean;