diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb7d143..9b0937d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,14 +13,34 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ## Unreleased
 
-Docs and comments only: this entry changes no pin. Two of the files are
-baked into the base image (`rootfs/usr/local/bin/studio-expose` and the
-`pi-devbox-environment` skill), and `base_tag` hashes all of `rootfs/`, so
-**the next release rebuilds the base** rather than reusing
-`base-6f3b20266de1`.
+No pin changes. One floating component moves (pi-extensions, below); the rest
+is docs and comments. Two of the edited files are baked into the base image
+(`rootfs/usr/local/bin/studio-expose` and the `pi-devbox-environment` skill),
+and `base_tag` hashes all of `rootfs/`, so **the next release rebuilds the
+base** rather than reusing `base-6f3b20266de1`.
+
+### Components that move with the next build
+
+| Component | Baked in v1.11.2 | Next build | Why |
+|---|---|---|---|
+| pi-extensions | `750b2a8` | **`0d8e417`** (or later: CI resolves `main` at build time) | the AWS SSO keeper prints clock times in 24-hour format whatever the locale (below) |
 
 ### Fixed
 
+- **The AWS SSO keeper showed 12-hour times under the image's default
+  locale** (pi-extensions `0d8e417`). The status line (`AWS ✓ since …` /
+  `until …`), `/aws-sso status`, the "session ended at" login notice and the
+  "last login" line used `toLocaleTimeString()` / `toLocaleString()`. Those
+  follow the locale, and `Dockerfile.base` sets `LC_ALL=en_US.UTF-8`, so the
+  TUI read `AWS ✓ since 01:25 PM`. Times are now always `HH:MM`, and "last
+  login" is `YYYY-MM-DD HH:MM:SS`, the forms `docs/aws-sso.md` already showed.
+  A device that overrides the locale in `.env` (the `sv_SE.UTF-8` example in
+  `.env.example`) already saw 24-hour times and sees no change. Measured in a
+  v1.11.2 container: Node formats 13:25 as `"01:25 PM"` under `en_US.UTF-8`
+  and `C.UTF-8` and as `"13:25"` under `sv_SE.UTF-8`. The upstream test suite
+  at `0d8e417` passes 18/18 under `en_US.UTF-8`, including the new
+  "hhmm/fmtStamp are 24-hour, locale-independent" case.
+
 - **README "Using pi-studio" said pi-studio has no bind flag.** It has had
   `/studio --listen-all` (binds `0.0.0.0`) since pi-studio 0.9.60, so the
   section now lists it as path **C**, next to host networking (A) and the