diff --git a/core/tools/headertool.py b/core/tools/headertool.py
index a24dc05f3..825483f3c 100755
--- a/core/tools/headertool.py
+++ b/core/tools/headertool.py
@@ -90,6 +90,9 @@ def process_remote_signers(fw, addrs: List[str]) -> Tuple[int, List[bytes]]:
         sigs.append(sig)
         click.echo("OK")
 
+    for _, proxy in proxies:
+        proxy.finish()
+
     # compute global signature
     return sigmask, cosi.combine_sig(global_R, sigs)
 
diff --git a/core/tools/keyctl-proxy b/core/tools/keyctl-proxy
index 0e14ebe62..6e10d0eea 100755
--- a/core/tools/keyctl-proxy
+++ b/core/tools/keyctl-proxy
@@ -57,7 +57,10 @@ def make_commit(name, index, digest):
 
 @Pyro4.expose
 class KeyctlProxy:
-    def __init__(self, image_type, digest: bytes, commit: Tuple[bytes, bytes]) -> None:
+    def __init__(
+        self, daemon, image_type, digest: bytes, commit: Tuple[bytes, bytes]
+    ) -> None:
+        self.daemon = daemon
         self.name = image_type.NAME
         self.address_n = parse_path(PATH.format(image_type.BIP32_INDEX))
         self.digest = digest
@@ -88,6 +91,11 @@ class KeyctlProxy:
                 traceback.print_exc()
                 click.echo("Trying again ...")
 
+    @Pyro4.oneway
+    def finish(self):
+        click.echo("Done! \\(^o^)/")
+        self.daemon.shutdown()
+
 
 @click.command()
 @click.option(
@@ -125,7 +133,7 @@ def cli(ipaddr, fw_file, fw_or_type, digest):
         break
 
     daemon = Pyro4.Daemon(host=ipaddr, port=PORT)
-    proxy = KeyctlProxy(fw_or_type, digest, (pubkey, R))
+    proxy = KeyctlProxy(daemon, fw_or_type, digest, (pubkey, R))
     uri = daemon.register(proxy, "keyctl")
     click.echo(f"keyctl-proxy running at URI: {uri}")
     click.echo("Press Ctrl+C to abort.")