diff --git a/CHANGELOG.md b/CHANGELOG.md
index 99c0992..ff9d2b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,54 @@
 # Changelog
 
+## [2.3.0] - 2026-07-24
+
+**✨ New**
+
+- Guided setup wizard, now the default command: *lim* with no *--type* (or
+  *lim --type guided*) asks everything up front — distribution, target device,
+  hostname, login user + SSH key, password — then builds an encrypted,
+  Tor-remote-unlockable image unattended.
+- Debian / Raspberry Pi OS remote LUKS unlock. The initramfs unlock stack is
+  now distro-agnostic behind an *InitramfsBackend* abstraction: *mkinitcpio*
+  for Arch/Manjaro, *initramfs-tools* (cryptsetup-initramfs + dropbear-initramfs
+  + a Tor onion) for Raspberry Pi OS / moode / RetroPie.
+- Flash full disk images into LUKS. Distributions that ship a *.img* rather
+  than a rootfs tarball (Raspberry Pi OS, moode, RetroPie, Manjaro ARM) are
+  loop-mounted and their boot + root partitions copied into a fresh LUKS
+  container. New Raspberry Pi OS catalog (*lite64* / *desktop64* / *lite32*).
+- New *remote-unlock* command: reach a waiting initramfs over Tor (onion, via
+  *torsocks*) or plain SSH (host/IP), running *cryptroot-unlock* or presenting
+  the passphrase prompt. The wizard saves a target record under
+  *~/.config/lim/unlocks* so *lim --type remote-unlock* offers it directly.
+- Cross-architecture builds. Building a foreign-arch image (e.g. arm64
+  Raspberry Pi OS on an x86 host) auto-installs *qemu-user-static* and registers
+  binfmt, or aborts before the target is erased with per-distro instructions.
+- RTC-less clock hardening. A clock floor (build epoch baked into the initramfs)
+  plus a numeric *tor_ntp=* cmdline let the clock sync without DNS, so the Tor
+  onion still publishes on boards without a real-time clock (which boot at 1970).
+- Numbered selection menus for distribution and version prompts; typing the
+  name still works.
+- CI: a full Debian *build → boot → LUKS-unlock* QEMU end-to-end job runs on
+  push (*make test-qemu-debian*).
+
+**🐛 Fixes**
+
+- Raspberry Pi OS Bookworm boots the encrypted image: the initramfs is placed on
+  the *​/boot/firmware* FAT partition instead of the ext4 root, so cryptsetup is
+  present at boot (no more *(initramfs)* emergency shell).
+- Chroot package installs are robust cross-host: a Debian-safe *PATH* (so
+  *update-initramfs* / *useradd* resolve) and *apt-get update* before install
+  (stock images ship stale lists whose superseded *.deb* URLs 404).
+- Stock-image *fstab* is normalized (the existing *​/* line is replaced, not
+  duplicated) when copying a distro image into LUKS.
+- Large copies show progress (*rsync --info=progress2*, *cp* fallback).
+
+**💥 Breaking / behavior**
+
+- *lim* with no *--type* now runs the guided wizard (previously *--type* was
+  required).
+- The long-deprecated *--extra* argument is removed.
+
 ## [2.2.0] - 2026-07-21
 
 - Optional remote LUKS unlock via a Tor onion service in the initramfs.
diff --git a/pyproject.toml b/pyproject.toml
index 12e6a32..acf8cdc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "linux-image-manager"
-version = "2.2.0"
+version = "2.3.0"
 description = "CLI (`lim`) for downloading, verifying and flashing Linux images, LUKS/Btrfs encrypted storage (single drive and RAID1), image backups and chroot maintenance"
 readme = "README.md"
 requires-python = ">=3.10"