diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,13 @@
 
 ## Unreleased
 
+## [0.3.3] - 2019-09-25
+
+### Fixed
+
+- #236: fix hang during push
+- #233: push: if multiple caches exist, pick the latest signing key
+
 ## [0.3.2] - 2019-09-16
 
 - #232: brownbag release due to a bug in release process
@@ -121,6 +128,8 @@
 - Initial release @domenkozar
 
 [Unreleased]: https://github.com/cachix/cachix/compare/v0.3.0...HEAD
+[0.3.3]: https://github.com/cachix/cachix/compare/v0.3.2...v0.3.3
+[0.3.2]: https://github.com/cachix/cachix/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/cachix/cachix/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/cachix/cachix/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/cachix/cachix/compare/v0.2.0...v0.2.1
diff --git a/cachix.cabal b/cachix.cabal
--- a/cachix.cabal
+++ b/cachix.cabal
@@ -1,6 +1,6 @@
 cabal-version:      2.2
 name:               cachix
-version: 0.3.2
+version: 0.3.3
 license:            Apache-2.0
 license-file:       LICENSE
 copyright:          2018 Domen Kožar
@@ -124,6 +124,7 @@
   import:             defaults
   main-is:            Main.hs
   build-tool-depends: hspec-discover:hspec-discover -any
+  ghc-options:        -threaded -rtsopts -with-rtsopts=-N
   hs-source-dirs:     cachix
   other-modules:      Paths_cachix
   autogen-modules:    Paths_cachix
@@ -135,6 +136,7 @@
 test-suite cachix-test
   import:         defaults
   type:           exitcode-stdio-1.0
+  ghc-options:    -threaded -rtsopts -with-rtsopts=-N
   main-is:        Main.hs
   hs-source-dirs: test
   other-modules:
diff --git a/src/Cachix/Client/Commands.hs b/src/Cachix/Client/Commands.hs
--- a/src/Cachix/Client/Commands.hs
+++ b/src/Cachix/Client/Commands.hs
@@ -44,7 +44,7 @@
 import Control.Retry (RetryStatus (rsIterNumber))
 import Crypto.Sign.Ed25519
 import qualified Data.ByteString.Base64 as B64
-import Data.List (isSuffixOf)
+import Data.List (isSuffixOf, reverse)
 import Data.Maybe (fromJust)
 import Data.String.Here
 import qualified Data.Text as T
@@ -90,7 +90,7 @@
               $ Api.createKey (cachixBCClient name) (authToken config) signingKeyCreate
             )
   -- if key was successfully added, write it to the config
-  -- TODO: this breaks if more than one key is added, see #27
+  -- TODO: warn if binary cache with the same key already exists
   writeConfig (configPath (cachixoptions env))
     $ config {binaryCaches = binaryCaches config <> [bcc]}
   putStrLn
@@ -199,7 +199,8 @@
   -> IO SigningKey -- ^ Secret key or exception
 findSigningKey env name = do
   maybeEnvSK <- lookupEnv "CACHIX_SIGNING_KEY"
-  let matches c = filter (\bc -> Config.name bc == name) $ binaryCaches c
+  -- we reverse list of caches to prioritize keys added as last
+  let matches c = filter (\bc -> Config.name bc == name) $ reverse $ binaryCaches c
       maybeBCSK = case config env of
         Nothing -> Nothing
         Just c -> Config.secretKey <$> head (matches c)