diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## [HEAD]
 
+## [0.5.0.3] - 2017-05-24
+### Changed
+- Fixed dependencies' bounds.
+
 ## [0.5.0.2] - 2017-04-26
 ### Changed
 - Fixed dependencies' bounds.
@@ -109,7 +113,8 @@
 - Initial version of the package.
 
 
-[HEAD]:    ../../compare/v0.5.0.2...HEAD
+[HEAD]:    ../../compare/v0.5.0.3...HEAD
+[0.5.0.3]: ../../compare/v0.5.0.2...v0.5.0.3
 [0.5.0.2]: ../../compare/v0.5.0.1...v0.5.0.2
 [0.5.0.1]: ../../compare/v0.5.0...v0.5.0.1
 [0.5.0]:   ../../compare/v0.4.4...v0.5.0
diff --git a/servant-auth-cookie.cabal b/servant-auth-cookie.cabal
--- a/servant-auth-cookie.cabal
+++ b/servant-auth-cookie.cabal
@@ -1,5 +1,5 @@
 name:                servant-auth-cookie
-version:             0.5.0.2
+version:             0.5.0.3
 synopsis:            Authentication via encrypted cookies
 description:         Authentication via encrypted client-side cookies,
                      inspired by client-session library by Michael Snoyman and based on
@@ -57,8 +57,8 @@
                , http-types     >= 0.9   && < 0.10
                , memory         >= 0.11  && < 0.15
                , mtl            >= 2.0  && < 3.0
-               , servant        >= 0.5   && < 0.11
-               , servant-server >= 0.5   && < 0.11
+               , servant        >= 0.5   && < 0.12
+               , servant-server >= 0.5   && < 0.12
                , tagged         == 0.8.*
                , time           >= 1.5   && < 1.8.1
                , transformers   >= 0.4   && < 0.6
@@ -103,7 +103,7 @@
                , deepseq        >= 1.3  && < 1.5
                , hspec          >= 2.0  && < 3.0
                , servant-auth-cookie
-               , servant-server >= 0.5  && < 0.11
+               , servant-server >= 0.5  && < 0.12
                , transformers   >= 0.4   && < 0.6
                , time           >= 1.5  && < 1.8.1
   if !impl(ghc >= 7.8)
@@ -131,10 +131,10 @@
                  , http-media
                  , http-types
                  , mtl            >= 2.0  && < 3.0
-                 , servant        >= 0.5  && < 0.11
+                 , servant        >= 0.5  && < 0.12
                  , servant-auth-cookie
                  , servant-blaze  >= 0.5  && < 0.10
-                 , servant-server >= 0.5  && < 0.11
+                 , servant-server >= 0.5  && < 0.12
                  , text
                  , time
                  , transformers   >= 0.4  && < 0.6
@@ -189,7 +189,7 @@
                  , QuickCheck     >= 2.4  && < 3.0
                  , servant-auth-cookie
                  , servant-blaze  >= 0.5  && < 0.10
-                 , servant-server >= 0.5  && < 0.11
+                 , servant-server >= 0.5  && < 0.12
                  , text
                  , time           >= 1.5  && < 1.8.1
                  , transformers   >= 0.4  && < 0.6
@@ -230,7 +230,7 @@
                , criterion      >= 0.6.2.1 && < 1.2
                , cryptonite     >= 0.14    && < 0.24
                , servant-auth-cookie
-               , servant-server >= 0.5     && < 0.11
+               , servant-server >= 0.5     && < 0.12
   if flag(dev)
     ghc-options:      -Wall -Werror
   else
diff --git a/src/Servant/Server/Experimental/Auth/Cookie.hs b/src/Servant/Server/Experimental/Auth/Cookie.hs
--- a/src/Servant/Server/Experimental/Auth/Cookie.hs
+++ b/src/Servant/Server/Experimental/Auth/Cookie.hs
@@ -78,7 +78,7 @@
   ) where
 
 import Blaze.ByteString.Builder (toByteString)
-import Control.Arrow ((&&&), first, second)
+import Control.Arrow ((&&&), first)
 import Control.Monad
 import Control.Monad.Catch (MonadThrow (..), Exception)
 import Control.Monad.Except
@@ -341,9 +341,9 @@
     userState = snd
 
   removeKey RenewableKeySet {..} key = do
-    found <- liftIO $ atomicModifyIORef' rksState $ \state -> let
-      (keys', found) = second (not . null) . partition (/= key) . fst $ state
-      in (first (const keys') state, found)
+    found <- liftIO $ atomicModifyIORef' rksState $ \(keys, s) -> let
+      (found, keys') = first (not . null) . partition (== key) $ keys
+      in ((keys', s), found)
     when found $ (rkshRemoveKey rksHooks) rksParameters key
 
 -- | Create instance of 'RenewableKeySet'.