diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,8 @@
+0.5.0.2
+-------
+* Use tar 0.5.0
+* Relax lower bound on directory
+
 0.5.0.1
 -------
 * Relaxed dependency bounds
diff --git a/hackage-security.cabal b/hackage-security.cabal
--- a/hackage-security.cabal
+++ b/hackage-security.cabal
@@ -1,5 +1,5 @@
 name:                hackage-security
-version:             0.5.0.1
+version:             0.5.0.2
 synopsis:            Hackage security library
 description:         The hackage security library provides both server and
                      client utilities for securing the Hackage package server
@@ -94,22 +94,18 @@
   -- We support ghc 7.4 (bundled with Cabal 1.14) and up
   build-depends:       base              >= 4.5     && < 5,
                        base64-bytestring >= 1.0     && < 1.1,
-                       -- When we call 'serialize' from the 'tar' package on
-                       -- a 'TarIndex', we get a 'Builder', so we need >= 0.10
-                       bytestring        >= 0.10    && < 0.11,
+                       bytestring        >= 0.9     && < 0.11,
                        Cabal             >= 1.14    && < 1.25,
                        containers        >= 0.4     && < 0.6,
-                       directory         >= 1.2.0.1 && < 1.3,
+                       directory         >= 1.1.0.2 && < 1.3,
                        ed25519           >= 0.0     && < 0.1,
                        filepath          >= 1.2     && < 1.5,
                        mtl               >= 2.2     && < 2.3,
                        parsec            >= 3.1     && < 3.2,
                        cryptohash        >= 0.11    && < 0.12,
-                       -- version 0.4.2 of tar introduces TarIndex
-                       -- version 0.4.2.2 contains a crucial bugfix
-                       -- version 0.4.4 introduces some more Index functionality
-                       -- versions 0.4.3 and 0.4.4 were blacklisted
-                       tar               >= 0.4.5   && < 0.5,
+                       -- 0.4.2 introduces TarIndex, 0.4.4 introduces more
+                       -- functionality, 0.5.0 changes type of serialise
+                       tar               >= 0.5     && < 0.6,
                        time              >= 1.2     && < 1.7,
                        transformers      >= 0.4     && < 0.6,
                        zlib              >= 0.5     && < 0.7,
@@ -143,7 +139,7 @@
                        PackageImports
                        UndecidableInstances
   -- use the new stage1/cross-compile-friendly Quotes subset of TH for new GHCs
-  if impl(ghc >= 800)
+  if impl(ghc >= 8.0)
     -- place holder until Hackage allows to edit in the new extension token
     -- other-extensions: TemplateHaskellQuotes
     other-extensions:
diff --git a/src/Hackage/Security/Client/Repository/Cache.hs b/src/Hackage/Security/Client/Repository/Cache.hs
--- a/src/Hackage/Security/Client/Repository/Cache.hs
+++ b/src/Hackage/Security/Client/Repository/Cache.hs
@@ -1,5 +1,4 @@
 {-# LANGUAGE BangPatterns #-}
-{-# LANGUAGE CPP #-}
 -- | The files we cache from the repository
 --
 -- Both the Local and the Remote repositories make use of this module.
@@ -9,7 +8,6 @@
   , getCachedRoot
   , getCachedIndex
   , clearCache
---  , getFromIndex
   , withIndex
   , getIndexIdx
   , cacheRemoteFile
@@ -23,14 +21,9 @@
 import qualified Codec.Archive.Tar       as Tar
 import qualified Codec.Archive.Tar.Index as TarIndex
 import qualified Codec.Compression.GZip  as GZip
+import qualified Data.ByteString         as BS
 import qualified Data.ByteString.Lazy    as BS.L
 
-#if MIN_VERSION_bytestring(0,10,2)
-import Data.ByteString.Builder      as BS.Builder
-#else
-import Data.ByteString.Lazy.Builder as BS.Builder
-#endif
-
 import Hackage.Security.Client.Repository
 import Hackage.Security.Client.Formats
 import Hackage.Security.TUF
@@ -100,7 +93,7 @@
         Left  ex  -> throwUnchecked ex
         Right idx -> withFile (cachedIndexIdxPath cache) WriteMode $ \hIdx -> do
                        hSetBuffering hIdx (BlockBuffering Nothing)
-                       BS.Builder.hPutBuilder hIdx $ TarIndex.serialise idx
+                       BS.hPut hIdx $ TarIndex.serialise idx
   where
     -- The initial index builder
     -- If we don't have an index (or it's broken), we start from scratch