diff --git a/src/authentic2_gnm/management/commands/sync-cut.py b/src/authentic2_gnm/management/commands/sync-cut.py
index 31124f5..3b1bb92 100644
--- a/src/authentic2_gnm/management/commands/sync-cut.py
+++ b/src/authentic2_gnm/management/commands/sync-cut.py
@@ -63,36 +63,40 @@ class Command(BaseCommand):
         # update recently modified users
         url = settings.CUT_API_BASE_URL + 'users/?modified__gt=%s' % (
                 datetime.datetime.now() - datetime.timedelta(seconds=delta)).strftime('%Y-%m-%dT%H:%M:%S')
-        resp = requests.get(url, auth=settings.CUT_API_CREDENTIALS)
-        resp.raise_for_status()
-        for user_dict in resp.json()['results']:
-            try:
-                account = OIDCAccount.objects.get(user__email=user_dict['email'])
-            except OIDCAccount.DoesNotExist:
-                continue
-            had_changes = False
-            for claim in cut_users.claim_mappings.all():
-                if '{{' in claim.claim or '{%' in claim.claim:
-                    template = Template(claim.claim)
-                    attribute_value = template.render(context=user_dict)
-                else:
-                    attribute_value = user_dict.get(claim.claim)
+        while url:
+            resp = requests.get(url, auth=settings.CUT_API_CREDENTIALS)
+            resp.raise_for_status()
+            url = resp.json().get('next')
+            if verbose:
+                print('got %s users' % len(resp.json()['results']))
+            for user_dict in resp.json()['results']:
                 try:
-                    old_attribute_value = getattr(account.user, claim.attribute)
-                except AttributeError:
-                    try:
-                        old_attribute_value = getattr(account.user.attributes, claim.attribute)
-                    except AttributeError:
-                        old_attribute_value = None
-                if old_attribute_value == attribute_value:
+                    account = OIDCAccount.objects.get(user__email=user_dict['email'])
+                except OIDCAccount.DoesNotExist:
                     continue
-                had_changes = True
-                setattr(account.user, claim.attribute, attribute_value)
-                try:
-                    setattr(account.user.attributes, claim.attribute, attribute_value)
-                except AttributeError:
-                    pass
-            if had_changes:
-                if verbose:
-                    print('had changes, saving %r' % account.user)
-                account.user.save()
+                had_changes = False
+                for claim in cut_users.claim_mappings.all():
+                    if '{{' in claim.claim or '{%' in claim.claim:
+                        template = Template(claim.claim)
+                        attribute_value = template.render(context=user_dict)
+                    else:
+                        attribute_value = user_dict.get(claim.claim)
+                    try:
+                        old_attribute_value = getattr(account.user, claim.attribute)
+                    except AttributeError:
+                        try:
+                            old_attribute_value = getattr(account.user.attributes, claim.attribute)
+                        except AttributeError:
+                            old_attribute_value = None
+                    if old_attribute_value == attribute_value:
+                        continue
+                    had_changes = True
+                    setattr(account.user, claim.attribute, attribute_value)
+                    try:
+                        setattr(account.user.attributes, claim.attribute, attribute_value)
+                    except AttributeError:
+                        pass
+                if had_changes:
+                    if verbose:
+                        print('had changes, saving %r' % account.user)
+                    account.user.save()