diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,12 +7,19 @@
 
 ## Unreleased
 
+## [0.3.1] - 2019-09-16
+
+### Fixed
+
+- #229: correctly assert write permissions for NixOS
+- #228: flush stderr before exiting
+
 ## [0.3.0] - 2019-09-03
 
 ### Changed
 
 - #222 allow NixOS installation only as root
-- #215 LTS-14.0 and replace stack2nix with haskell.nix
+- #215 LTS-14.0 support and for development replace stack2nix with haskell.nix
 - #216 add bulk store path querying as a performance optimization
 - #222 drop support for Nix 2.0.1 or lower
 
@@ -110,6 +117,7 @@
 - Initial release @domenkozar
 
 [Unreleased]: https://github.com/cachix/cachix/compare/v0.3.0...HEAD
+[0.3.1]: https://github.com/cachix/cachix/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/cachix/cachix/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/cachix/cachix/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/cachix/cachix/compare/v0.1.3...v0.2.0
diff --git a/cachix.cabal b/cachix.cabal
--- a/cachix.cabal
+++ b/cachix.cabal
@@ -1,158 +1,156 @@
-cabal-version:      2.2
-name:               cachix
-version:            0.3.0
-synopsis:
-  Command line client for Nix binary cache hosting https://cachix.org
-
-homepage:           https://github.com/cachix/cachix#readme
-bug-reports:        https://github.com/cachix/cachix/issues
-author:             Domen Kožar
-maintainer:         domen@enlambda.com
-copyright:          2018 Domen Kožar
-license:            Apache-2.0
-license-file:       LICENSE
-build-type:         Simple
+cabal-version: 2.2
+name: cachix
+version: 0.3.1
+license: Apache-2.0
+license-file: LICENSE
+copyright: 2018 Domen Kožar
+maintainer: domen@enlambda.com
+author: Domen Kožar
+homepage: https://github.com/cachix/cachix#readme
+bug-reports: https://github.com/cachix/cachix/issues
+synopsis: Command line client for Nix binary cache hosting https://cachix.org
+build-type: Simple
 extra-source-files:
-  CHANGELOG.md
-  README.md
-  cbits/aliases.h
-  test/data/*.input
-  test/data/*.output
-
-common defaults
-  default-extensions:
-    NoImplicitPrelude
-    DeriveGeneric
-    OverloadedStrings
-    RecordWildCards
-
-  ghc-options:
-    -Wall -Wcompat -Wincomplete-record-updates
-    -Wincomplete-uni-patterns -Wredundant-constraints -fwarn-tabs
-    -fwarn-unused-imports -fwarn-missing-signatures
-    -fwarn-name-shadowing -fwarn-incomplete-patterns
-
-  default-language:   Haskell2010
+    CHANGELOG.md
+    README.md
+    cbits/aliases.h
+    test/data/*.input
+    test/data/*.output
 
 source-repository head
-  type:     git
-  location: https://github.com/cachix/cachix
+    type: git
+    location: https://github.com/cachix/cachix
 
 library
-  import:            defaults
-  exposed-modules:
-    Cachix.Client
-    Cachix.Client.Commands
-    Cachix.Client.Config
-    Cachix.Client.Config.Orphans
-    Cachix.Client.Env
-    Cachix.Client.Exception
-    Cachix.Client.InstallationMode
-    Cachix.Client.NetRc
-    Cachix.Client.NixConf
-    Cachix.Client.NixVersion
-    Cachix.Client.OptionsParser
-    Cachix.Client.Push
-    Cachix.Client.Secrets
-    Cachix.Client.Servant
-    Cachix.Client.Store
-    Cachix.Client.Store.Context
-    Cachix.Client.URI
-
-  other-modules:     Paths_cachix
-  autogen-modules:   Paths_cachix
-  hs-source-dirs:    src
-  build-depends:
-    , async
-    , base                  >=4.7     && <5
-    , base64-bytestring
-    , bytestring
-    , cachix-api
-    , conduit               >=1.3.0
-    , conduit-extra
-    , containers
-    , cookie
-    , cryptonite
-    , dhall
-    , directory
-    , ed25519
-    , filepath
-    , fsnotify
-    , here
-    , hnix-store-core
-    , http-client
-    , http-client-tls
-    , http-conduit
-    , http-types
-    , inline-c
-    , inline-c-cpp
-    , lzma-conduit
-    , megaparsec            >=7.0.0
-    , memory
-    , mmorph
-    , netrc
-    , optparse-applicative
-    , process
-    , protolude
-    , resourcet
-    , retry
-    , safe-exceptions
-    , servant               >=0.15
-    , servant-auth
-    , servant-auth-client   >=0.3.3.0
-    , servant-client        >=0.15
-    , servant-client-core   >=0.15
-    , servant-conduit
-    , text
-    , unix
-    , uri-bytestring
-    , versions
-
-  ghc-options:       -optc=-std=c++14
-
-  -- match what Nix is using
-  if os(osx)
-    ghc-options: -pgmc=clang++
-
-  cc-options:        -Wall
-  include-dirs:      cbits
-  extra-libraries:   stdc++
-  pkgconfig-depends: nix-store ==2.0 || >2.0, nix-main ==2.0 || >2.0
+    exposed-modules:
+        Cachix.Client
+        Cachix.Client.Commands
+        Cachix.Client.Config
+        Cachix.Client.Config.Orphans
+        Cachix.Client.Env
+        Cachix.Client.Exception
+        Cachix.Client.InstallationMode
+        Cachix.Client.NetRc
+        Cachix.Client.NixConf
+        Cachix.Client.NixVersion
+        Cachix.Client.OptionsParser
+        Cachix.Client.Push
+        Cachix.Client.Secrets
+        Cachix.Client.Servant
+        Cachix.Client.Store
+        Cachix.Client.Store.Context
+        Cachix.Client.URI
+    cc-options: -Wall
+    pkgconfig-depends: nix-store ==2.0 || >2.0, nix-main ==2.0 || >2.0
+    hs-source-dirs: src
+    other-modules:
+        Paths_cachix
+    autogen-modules:
+        Paths_cachix
+    default-language: Haskell2010
+    default-extensions: NoImplicitPrelude DeriveGeneric
+                        OverloadedStrings RecordWildCards
+    extra-libraries:
+        stdc++
+        boost_context
+    include-dirs: cbits
+    ghc-options: -Wall -Wcompat -Wincomplete-record-updates
+                 -Wincomplete-uni-patterns -Wredundant-constraints -fwarn-tabs
+                 -fwarn-unused-imports -fwarn-missing-signatures
+                 -fwarn-name-shadowing -fwarn-incomplete-patterns
+    build-depends:
+        async -any,
+        base >=4.7 && <5,
+        base64-bytestring -any,
+        bytestring -any,
+        cachix-api -any,
+        conduit >=1.3.0,
+        conduit-extra -any,
+        containers -any,
+        cookie -any,
+        cryptonite -any,
+        dhall -any,
+        directory -any,
+        ed25519 -any,
+        filepath -any,
+        fsnotify -any,
+        here -any,
+        hnix-store-core -any,
+        http-client -any,
+        http-client-tls -any,
+        http-conduit -any,
+        http-types -any,
+        inline-c -any,
+        inline-c-cpp -any,
+        lzma-conduit -any,
+        megaparsec >=7.0.0,
+        memory -any,
+        mmorph -any,
+        netrc -any,
+        optparse-applicative -any,
+        process -any,
+        protolude -any,
+        resourcet -any,
+        retry -any,
+        safe-exceptions -any,
+        servant >=0.15,
+        servant-auth -any,
+        servant-auth-client >=0.3.3.0,
+        servant-client >=0.15,
+        servant-client-core >=0.15,
+        servant-conduit -any,
+        text -any,
+        unix -any,
+        uri-bytestring -any,
+        versions -any
+    
+    if os(osx)
+        ghc-options: -pgmc=clang++
 
 executable cachix
-  import:             defaults
-  main-is:            Main.hs
-  other-modules:      Paths_cachix
-  autogen-modules:    Paths_cachix
-  hs-source-dirs:     cachix
-  ghc-options:        -threaded -rtsopts -with-rtsopts=-N
-  build-depends:
-    , base        >=4.7 && <5
-    , cachix
-    , cachix-api
-
-  build-tool-depends: hspec-discover:hspec-discover -any
+    main-is: Main.hs
+    build-tool-depends: hspec-discover:hspec-discover -any
+    hs-source-dirs: cachix
+    other-modules:
+        Paths_cachix
+    autogen-modules:
+        Paths_cachix
+    default-language: Haskell2010
+    default-extensions: NoImplicitPrelude DeriveGeneric
+                        OverloadedStrings RecordWildCards
+    ghc-options: -Wall -Wcompat -Wincomplete-record-updates
+                 -Wincomplete-uni-patterns -Wredundant-constraints -fwarn-tabs
+                 -fwarn-unused-imports -fwarn-missing-signatures
+                 -fwarn-name-shadowing -fwarn-incomplete-patterns
+    build-depends:
+        base >=4.7 && <5,
+        cachix -any,
+        cachix-api -any
 
 test-suite cachix-test
-  import:         defaults
-  type:           exitcode-stdio-1.0
-  main-is:        Main.hs
-  other-modules:
-    InstallationModeSpec
-    NetRcSpec
-    NixConfSpec
-    NixVersionSpec
-    Paths_cachix
-    Spec
-
-  hs-source-dirs: test
-  ghc-options:    -threaded -rtsopts -with-rtsopts=-N
-  build-depends:
-    , base        >=4.7 && <5
-    , cachix
-    , cachix-api
-    , directory
-    , here
-    , hspec
-    , protolude
-    , temporary
+    type: exitcode-stdio-1.0
+    main-is: Main.hs
+    hs-source-dirs: test
+    other-modules:
+        InstallationModeSpec
+        NetRcSpec
+        NixConfSpec
+        NixVersionSpec
+        Paths_cachix
+        Spec
+    default-language: Haskell2010
+    default-extensions: NoImplicitPrelude DeriveGeneric
+                        OverloadedStrings RecordWildCards
+    ghc-options: -Wall -Wcompat -Wincomplete-record-updates
+                 -Wincomplete-uni-patterns -Wredundant-constraints -fwarn-tabs
+                 -fwarn-unused-imports -fwarn-missing-signatures
+                 -fwarn-name-shadowing -fwarn-incomplete-patterns
+    build-depends:
+        base >=4.7 && <5,
+        cachix -any,
+        cachix-api -any,
+        directory -any,
+        here -any,
+        hspec -any,
+        protolude -any,
+        temporary -any
diff --git a/cachix/Main.hs b/cachix/Main.hs
--- a/cachix/Main.hs
+++ b/cachix/Main.hs
@@ -21,4 +21,5 @@
     handler e = do
       hPutStrLn stderr ""
       hPutStr stderr (displayException e)
+      hFlush stderr
       exitFailure
diff --git a/src/Cachix/Client/InstallationMode.hs b/src/Cachix/Client/InstallationMode.hs
--- a/src/Cachix/Client/InstallationMode.hs
+++ b/src/Cachix/Client/InstallationMode.hs
@@ -98,7 +98,7 @@
 
 nixosBinaryCache :: Maybe Config -> Api.BinaryCache -> UseOptions -> IO ()
 nixosBinaryCache maybeConfig bc@Api.BinaryCache {..} UseOptions {useNixOSFolder = baseDirectory} = do
-  eitherPermissions <- try $ getPermissions (toS toplevel) :: IO (Either SomeException Permissions)
+  eitherPermissions <- try $ getPermissions (toS baseDirectory) :: IO (Either SomeException Permissions)
   case eitherPermissions of
     Left _ -> throwIO $ NixOSInstructions noEtcPermissionInstructions
     Right permissions
