diff --git a/changelog b/changelog
--- a/changelog
+++ b/changelog
@@ -35,9 +35,30 @@
 	* opened up the export of Data.KeyStore.Types
 	* added getSettingsOpt' to Data.KeyStore.KS.Opt
 	* Fix #1, (section, key and host prefixes)
+	* NB: this release will auto-migrate a keystore reformating the identifers
+	  to life the 'no-prefixes' restrictions BUT:
+	    + the change of format will only persist when the store is written
+	      back, which usually only happens on an edit operation that
+	      changes the keystore (e.g., by rotating a key) or, better, by forcing
+	      the kmeystore to be written back);
+	    + the keystore's (detached) signature will not be migrated
+	      but you will have to re-sign the keystore after it has been
+	      reformatted anyway; your best bet is to remove the signature (to prevent
+	      an error arising from the failure to find the signing key under
+	      its old name, (mis)identified in the signature) and resigning the
+	      store.
 
+	  For example, to migrate the example store, you could do something like this:
+
+	      $ rm deploy-keystore.hash
+	      $ deploy -w sign
+
 0.5.0.1 Chris Dornan <chrisd@irisconnect.co.uk> 2014-07-28
 	* fix default sectionPWEnvVar in Sections class
 
 0.5.0.2 Chris Dornan <chrisd@irisconnect.co.uk> 2014-07-28
 	* improve build stability of Sections: list the things we need from Control.Lens
+
+0.5.0.3 Chris Dornan <chrisd@irisconnect.co.uk> 2014-07-30
+	* fix key-formatting bug (gratuitious insertion of double '/'s before the
+	  version number)
diff --git a/keystore.cabal b/keystore.cabal
--- a/keystore.cabal
+++ b/keystore.cabal
@@ -1,5 +1,5 @@
 Name:                   keystore
-Version:                0.5.0.2
+Version:                0.5.0.3
 Synopsis:               Managing stores of secret things
 Homepage:               http://github.com/cdornan/keystore
 Author:                 Chris Dornan
@@ -116,6 +116,13 @@
   .
   See the bottom <https://github.com/cdornan/keystore#launch-instructions README>
   on GitHub home page for launch instructions for the deploy example.
+  .
+  /0.5 Migration instructions/
+  .
+  The formation of the names used in 'Data.Keystore.Sections' derived keystores
+  has changed to fix an issue (#3) that barred hosts, sections and key identifiers
+  from being prefixes of each other. See the changelog for details, especially
+  on how to ensure that an existing Sections-based keystore gets migrated properly.
 
 Extra-source-files:     changelog
 Cabal-version:          >= 1.14
diff --git a/src/Data/KeyStore/CLI.hs b/src/Data/KeyStore/CLI.hs
--- a/src/Data/KeyStore/CLI.hs
+++ b/src/Data/KeyStore/CLI.hs
@@ -18,7 +18,7 @@
 
 
 version :: String
-version = "0.5.0.2"
+version = "0.5.0.3"
 
 cli :: IO ()
 cli = parseCLI >>= command Nothing
diff --git a/src/Data/KeyStore/Sections.hs b/src/Data/KeyStore/Sections.hs
--- a/src/Data/KeyStore/Sections.hs
+++ b/src/Data/KeyStore/Sections.hs
@@ -300,7 +300,7 @@
     nm_s    = _name nm
     ic      = _REFORMAT ic'
 
--- | Return the genertic name for a given key thst is used by the specified
+-- | Return the generic name for a given key thst is used by the specified
 -- host, returning a failure diagnostic if the host does not have such a key
 -- on the given Section model.
 keyName :: Sections h s k => h -> k -> Retrieve Name
@@ -408,7 +408,7 @@
 backup_password ic s sv_s = secureKey ic (passwordName s) $ safeguard [sve_nme sv_s]
 
 key_nme :: Sections h s k => Maybe h -> s -> k -> Name
-key_nme mb_h s k = name' $ encode s ++ "/" ++ encode k ++ hst_sfx
+key_nme mb_h s k = name' $ encode s ++ "/" ++ encode k ++ hst_sfx ++ "/"
   where
     hst_sfx = maybe "" (\h -> "/" ++ encode h) mb_h
 
@@ -434,7 +434,7 @@
     c_nms = [ nm | i<-[length nms+1..], let nm=nname i nm0, nm `notElem` nms ]
 
     nname :: Int -> Name -> Name
-    nname i nm_ = name' $ _name nm_ ++ printf "/%03d" i
+    nname i nm_ = name' $ _name nm_ ++ printf "%03d" i
 
 the_keystore :: CtxParams -> FilePath
 the_keystore = maybe "keystore.json" id . cp_store