autoenv.zsh     | 43 ++++++++++++++++++++++++++++---------------
 tests/setup.zsh |  3 ++-

diff --git a/autoenv.zsh b/autoenv.zsh
index 2dbafe517a85da8475afaa876ea5510b5cef7270..94ac677722c15ecbb48e8478961763b3093e89f3 100644
--- a/autoenv.zsh
+++ b/autoenv.zsh
@@ -192,30 +192,43 @@   ret_pair=":${env_file}:${env_cksum}:${cksum_version}"
 }
 
 
-# Checks for the existence of a hash signature in the auth file
-_autoenv_authorized_pair() {
-  local pair=$1
-  test -f $AUTOENV_AUTH_FILE \
-    && \grep -qF $pair $AUTOENV_AUTH_FILE
-}
-
-
+# Check if a given env_file is authorized.
 _autoenv_authorized_env_file() {
   local env_file=$1
+  local env_file_abs=${env_file:A}
   local ret_pair
-  _autoenv_hash_pair $env_file
-  _autoenv_debug "v2 pair: ${ret_pair}"
-  if ! _autoenv_authorized_pair $ret_pair; then
+
+  local -a lines
+  if [[ -f $AUTOENV_AUTH_FILE ]]; then
+    lines=( ${(M)"${(f@)"$(< $AUTOENV_AUTH_FILE)"}":#:$env_file_abs:*} )
+  fi
+  if [[ -z $lines ]]; then
+    return 1
+  fi
+
+  if (( $#lines != 1 )); then
+    echo "zsh-autoenv: found unexpected number ($#lines) of auth entries for $env_file in $AUTOENV_AUTH_FILE." >&2
+    echo $lines
+  fi
+  line=${lines[-1]}
+
+  if [[ $line == *:2 ]]; then
+    _autoenv_hash_pair $env_file
+    _autoenv_debug "Checking v2 pair: ${ret_pair}"
+    if [[ $line == $ret_pair ]]; then
+      return
+    fi
+  elif [[ $line == *:1 ]]; then
     # Fallback for v1 (SHA-1) pairs
+    _autoenv_debug "Checking v1 pair: ${ret_pair}"
     _autoenv_hash_pair $env_file 1
-    _autoenv_debug "v1 pair: ${ret_pair}"
-    if _autoenv_authorized_pair $ret_pair; then
+    if [[ $line == $ret_pair ]]; then
       # Upgrade v1 entries to v2
       _autoenv_authorize $env_file
-    else
-      return 1
+      return
     fi
   fi
+  return 1
 }
 
 _autoenv_authorize() {
diff --git a/tests/setup.zsh b/tests/setup.zsh
index 9b15bf1db0ca3ab22b56096e39e7e21d275cbfa2..0bbdbafa74ad8d9b7572b6b6bbae141d1512cef0 100644
--- a/tests/setup.zsh
+++ b/tests/setup.zsh
@@ -29,9 +29,10 @@
 # Add file ($1), version ($2), and optional hash ($3) to authentication file.
 test_autoenv_add_to_env() {
   [[ -d ${AUTOENV_AUTH_FILE:h} ]] || mkdir -p ${AUTOENV_AUTH_FILE:h}
+  _autoenv_deauthorize $1
   {
     local ret_pair
-    _autoenv_hash_pair $1 1 ${2:-} && echo $ret_pair
+    _autoenv_hash_pair $1 2 ${2:-} && echo $ret_pair
   } >>| $AUTOENV_AUTH_FILE
 }