diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,28 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.5]
+
+### Added
+
+ - The flake now has `.nixosModules.multi-agent-service` allowing multiple agents
+   to run on the same system.
+   An instance with default settings can be enabled with `services.hercules-ci-agents."some-name" = {}`.
+   User name and file paths are like the regular module, except replacing `hercules-ci-agent` by `hci-${name}` if the chosen `name` is not `""`.
+   `services.hercules-ci-agents."" = {}` is equivalent to `services.hercules-ci-agent.enable = true`.
+
+### Fixed
+
+ - Fix mounting `/etc/resolv.conf`, work around runc#1523. Fixed by @Mic92 in #357
+
+ - An issue where a Nix evaluator crash could lead to builds being triggered in
+   the backend for which the derivation hadn't been pushed to the cache yet,
+   causing needless build failures. #314
+
+ - A build error caused by a moved symbol in `cachix >= 0.7`. #363
+
+ - A test that relied on `aeson` field order, which isn't stable. #352
+
 ## [0.8.4]
 
 ### Added
diff --git a/hercules-ci-agent.cabal b/hercules-ci-agent.cabal
--- a/hercules-ci-agent.cabal
+++ b/hercules-ci-agent.cabal
@@ -1,7 +1,7 @@
 cabal-version: 2.4
 
 name:           hercules-ci-agent
-version:        0.8.4
+version:        0.8.5
 synopsis:       Runs Continuous Integration tasks on your machines
 category:       Nix, CI, Testing, DevOps
 homepage:       https://docs.hercules-ci.com
diff --git a/hercules-ci-agent/Hercules/Agent/Cachix/Init.hs b/hercules-ci-agent/Hercules/Agent/Cachix/Init.hs
--- a/hercules-ci-agent/Hercules/Agent/Cachix/Init.hs
+++ b/hercules-ci-agent/Hercules/Agent/Cachix/Init.hs
@@ -1,8 +1,13 @@
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE DataKinds #-}
 
 module Hercules.Agent.Cachix.Init where
 
+#if MIN_VERSION_cachix(0,7,0)
+import Cachix.Client.Version (cachixVersion)
+#else
 import Cachix.Client.Env (cachixVersion)
+#endif
 import qualified Cachix.Client.Push as Cachix.Push
 import qualified Cachix.Client.Secrets as Cachix.Secrets
 import Cachix.Client.URI (defaultCachixBaseUrl)
diff --git a/hercules-ci-agent/Hercules/Agent/Evaluate.hs b/hercules-ci-agent/Hercules/Agent/Evaluate.hs
--- a/hercules-ci-agent/Hercules/Agent/Evaluate.hs
+++ b/hercules-ci-agent/Hercules/Agent/Evaluate.hs
@@ -11,6 +11,7 @@
 import Conduit
 import qualified Control.Concurrent.Async.Lifted as Async.Lifted
 import Control.Concurrent.Chan.Lifted
+import Control.Exception.Lifted (finally)
 import qualified Data.Aeson as A
 import qualified Data.ByteString.Lazy as BL
 import Data.Char (isAsciiLower, isAsciiUpper)
@@ -78,6 +79,7 @@
 import qualified System.Directory as Dir
 import System.FilePath
 import System.Process
+import System.Timeout.Lifted (timeout)
 
 eventLimit :: Int
 eventLimit = 50000
@@ -210,11 +212,13 @@
               Message.message = e
             }
     Right file -> TraversalQueue.with $ \(derivationQueue :: Queue StorePath) ->
-      let doIt = do
-            Async.Lifted.concurrently_ evaluation emitDrvs
-            -- derivationInfo upload has finished
-            -- allAttrPaths :: IORef has been populated
-            pushDrvs
+      let doIt =
+            ( do
+                Async.Lifted.concurrently_ evaluation emitDrvs
+                -- derivationInfo upload has finished
+                -- allAttrPaths :: IORef has been populated
+            )
+              `finally` pushDrvs
           uploadDrvInfos drvPath = do
             TraversalQueue.enqueue derivationQueue drvPath
             TraversalQueue.waitUntilDone derivationQueue
@@ -222,19 +226,21 @@
             TraversalQueue.enqueue derivationQueue drvPath
             liftIO $ atomicModifyIORef topDerivationPaths ((,()) . S.insert drvPath)
           evaluation = do
-            Nix.withExtraOptions [("system", T.strip s) | Just s <- [adHocSystem]] $
-              runEvalProcess
-                projectDir
-                file
-                autoArguments
-                nixPath
-                captureAttrDrvAndEmit
-                uploadDrvInfos
-                sync
-                (EvaluateTask.logToken task)
-            -- process has finished
-            TraversalQueue.waitUntilDone derivationQueue
-            TraversalQueue.close derivationQueue
+            let evalProc = do
+                  Nix.withExtraOptions [("system", T.strip s) | Just s <- [adHocSystem]] $
+                    runEvalProcess
+                      projectDir
+                      file
+                      autoArguments
+                      nixPath
+                      captureAttrDrvAndEmit
+                      uploadDrvInfos
+                      sync
+                      (EvaluateTask.logToken task)
+            evalProc `finally` do
+              -- Always upload drv infos, even in case of a crash in the worker
+              TraversalQueue.waitUntilDone derivationQueue
+                `finally` TraversalQueue.close derivationQueue
           pushDrvs = do
             caches <- activePushCaches
             paths <- liftIO $ readIORef topDerivationPaths
diff --git a/src/Hercules/Effect.hs b/src/Hercules/Effect.hs
--- a/src/Hercules/Effect.hs
+++ b/src/Hercules/Effect.hs
@@ -150,7 +150,8 @@
             [ BindMount {pathInContainer = "/build", pathInHost = buildDir, readOnly = False},
               BindMount {pathInContainer = "/etc", pathInHost = etcDir, readOnly = False},
               BindMount {pathInContainer = "/secrets", pathInHost = secretsDir, readOnly = True},
-              BindMount {pathInContainer = "/etc/resolv.conf", pathInHost = "/etc/resolv.conf", readOnly = True},
+              -- we cannot bind mount this read-only because of https://github.com/opencontainers/runc/issues/1523
+              BindMount {pathInContainer = "/etc/resolv.conf", pathInHost = "/etc/resolv.conf", readOnly = False},
               BindMount {pathInContainer = "/nix/var/nix/daemon-socket/socket", pathInHost = "/nix/var/nix/daemon-socket/socket", readOnly = True}
             ],
           executable = decodeUtf8With lenientDecode drvBuilder,