diff --git a/CHANGELOG.md b/CHANGELOG.md
index c46eab7..6fc37e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.36.0] - 2026-10-23
+
 ### Added
 
 - **Site settings → Payments** (replaces the Yoco tab): turn each online payment provider on or off and set their order. The first one enabled and set up is used by default. Yoco's keys and webhook settings are on the same tab. Yoco is the only provider for now; PayFast, SnapScan and Zapper follow in the next releases. If no provider is on and set up, online payments are off and people pay at the door.
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 08ebf11..86b8de0 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.35.1",
+      "version": "1.36.0",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/adapter-pg": "^7.10.1",
diff --git a/backend/package.json b/backend/package.json
index 15bbff3..ab3dab0 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {
diff --git a/docs/HANDOVER.md b/docs/HANDOVER.md
index c4ca306..4c3d44d 100644
--- a/docs/HANDOVER.md
+++ b/docs/HANDOVER.md
@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-23, after **1.35.1**. The plan itself is in
+Last updated: 2026-10-23, after **1.36.0**. The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -12,21 +12,21 @@ features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 | 1.33.0 | Multi-day events phase A — sessions, late joining + late pricing, per-session check-in, attendance register, session reminders, certificates (4 templates, verify page) |
 | 1.34.0 | Background jobs on pg-boss (admin Background jobs page), Playwright e2e tests, Gitea CI workflow, `scripts/deploy.sh` |
 | 1.35.0 | Multi-day events phase B — "pick sessions" (per-session tickets and prices, session capacity) |
+| 1.36.0 | Payment provider interface (`backend/src/payments`) with Yoco behind it, `ProviderTransaction`, `Payment.provider`, Site settings → Payments (on/off and order per provider), R15 minimum |
 | 1.35.1 | Waitlist per session, session picker at the door, "All sessions" tickets let people tick sessions at one price; fixes (per-session stock limits, offline service worker serving stale scripts) |
 
 ## Next up
 
-1. **1.36.0 — payment provider interface.** Move Yoco behind a `PaymentProvider`
-   interface (`createCheckout`, `handleWebhook`, `getTransaction`, `refund`,
-   `listTransactions`) with no behaviour change; generalise `YocoTransaction` to a
-   provider transaction table; Site settings → Payments with an Enabled toggle per
-   provider and display order. Decisions: fees are **never** deducted or passed on
-   (people handle fees at cashup); minimum online payment **R15** for all providers.
-2. **1.37.0 PayFast → 1.38.0 SnapScan → 1.39.0 Zapper** (one release each). Get the
+1. **1.37.0 PayFast → 1.38.0 SnapScan → 1.39.0 Zapper** (one release each), each as a
+   provider in `backend/src/payments` (see "Where the payment code lives" below). Get the
    current API documentation links from Joshua before building each one, and don't
-   guess at an API — sandbox/test credentials needed for SnapScan and Zapper.
-3. **1.40.0–1.41.0 — POPIA toolkit** (spec §3 in the roadmap).
-4. **1.42.0 + Hub v1** — install/update tooling and the Hope Events Hub (separate repo
+   guess at an API — sandbox/test credentials needed for SnapScan and Zapper. With a second
+   provider the checkout needs a provider picker (the public `GET /api/payments/providers`
+   lists the enabled ones), and "pay online" buttons should hide below R15 / when none is on.
+   Decisions: fees are **never** deducted or passed on (people handle fees at cashup);
+   minimum online payment **R15** for all providers.
+2. **1.40.0–1.41.0 — POPIA toolkit** (spec §3 in the roadmap).
+3. **1.42.0 + Hub v1** — install/update tooling and the Hope Events Hub (separate repo
    `joshua/hope-events-hub`).
 
 ## Working on this repo
diff --git a/docs/ROADMAP-v2.md b/docs/ROADMAP-v2.md
index 9e2fe75..3028175 100644
--- a/docs/ROADMAP-v2.md
+++ b/docs/ROADMAP-v2.md
@@ -16,8 +16,8 @@ phase A (sessions, late joining, per-session check-in, attendance register,
 reminders, certificates); 1.34.0 job queue (pg-boss), Playwright E2E tests, Gitea CI
 workflow (waiting for a runner) and deploy script; 1.35.0 multi-day events phase B
 (pick sessions, per-session capacity), with 1.35.1 adding the per-session waitlist, the session
-picker at the door and session choice on "All sessions" tickets. **Next: 1.36.0 payment provider interface (Yoco
-moved behind it), then PayFast, SnapScan, Zapper.**
+picker at the door and session choice on "All sessions" tickets; 1.36.0 payment provider interface
+(Yoco moved behind it, Site settings → Payments). **Next: 1.37.0 PayFast, then SnapScan, Zapper.**
 
 **Repositories:**
 
@@ -725,7 +725,7 @@ keep adding to.
 | 1 | 1.33.0 ✅ | **Multi-day events — phase A** (sessions, whole-course tickets, late joining + late pricing, per-session check-in with whole-day window, attendance register, optional reminders, certificates) | Requested first; touches registration/tickets/scanning, so it shapes later work |
 | 2 | 1.34.0 ✅ | CI + Playwright E2E + job queue | Safety net before the riskiest work (payments). Session reminders move to the queue |
 | 3 | 1.35.0 ✅ | Multi-day events — phase B (pick sessions, per-session capacity) | Builds on phase A, now with E2E coverage |
-| 4 | 1.36.0 – 1.39.0 | Payment provider interface (Yoco moved behind it) → PayFast → SnapScan → Zapper, one release each | Payment code gets split out of the big controller as part of this |
+| 4 | 1.36.0 ✅ – 1.39.0 | Payment provider interface (Yoco moved behind it) → PayFast → SnapScan → Zapper, one release each | Payment code gets split out of the big controller as part of this |
 | 5 | 1.40.0 – 1.41.0 | **POPIA toolkit** (user privacy centre + unsubscribe first, then admin tools, retention jobs, readiness page) | Main selling point; retention jobs use the job queue |
 | 6 | 1.42.0 + Hub v1 | Install/update scripts, `/health`, licence step in `/setup`, "Connect to Hub", heartbeat, licence states — plus the **Hub** app (separate repo) | Must exist before the first church is sold; Hope Family Church registers as install #1 |
 | 7 | 1.43.0 | **Multi-campus** | Kids rooms and volunteer roles are per campus, so campuses come first |
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index ce0d0c4..c5cf4fd 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.35.1",
+      "version": "1.36.0",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",
diff --git a/frontend/package.json b/frontend/package.json
index db18d69..1c2b10d 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",
diff --git a/package-lock.json b/package-lock.json
index def61bd..9431b5c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.35.1",
+      "version": "1.36.0",
       "license": "ISC",
       "devDependencies": {
         "@playwright/test": "^1.64.0",
diff --git a/package.json b/package.json
index f2f124e..557b64b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",