diff --git a/twingate/internal/client/group.go b/twingate/internal/client/group.go
index 386be4c1..bbe12675 100644
--- a/twingate/internal/client/group.go
+++ b/twingate/internal/client/group.go
@@ -19,6 +19,7 @@ func (client *Client) CreateGroup(ctx context.Context, input *model.Group) (*mod
 		gqlVar(input.Name, "name"),
 		gqlIDs(input.Users, "userIds"),
 		gqlNullableID(input.SecurityPolicyID, "securityPolicyId"),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.CreateGroup{}
@@ -40,7 +41,10 @@ func (client *Client) ReadGroup(ctx context.Context, groupID string) (*model.Gro
 		return nil, opr.apiError(ErrGraphqlIDIsEmpty)
 	}
 
-	variables := newVars(gqlID(groupID))
+	variables := newVars(
+		gqlID(groupID),
+		gqlNullable("", query.CursorUsers),
+	)
 
 	response := query.ReadGroup{}
 	if err := client.query(ctx, &response, variables, opr, attr{id: groupID}); err != nil {
@@ -60,6 +64,7 @@ func (client *Client) ReadGroups(ctx context.Context, filter *model.GroupsFilter
 	variables := newVars(
 		gqlNullable(query.NewGroupFilterInput(filter), "filter"),
 		gqlNullable("", query.CursorGroups),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.ReadGroups{}
@@ -104,6 +109,7 @@ func (client *Client) UpdateGroup(ctx context.Context, input *model.Group) (*mod
 		gqlVar(input.Name, "name"),
 		gqlIDs(input.Users, "addedUserIds"),
 		gqlNullableID(input.SecurityPolicyID, "securityPolicyId"),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.UpdateGroup{}
@@ -147,6 +153,7 @@ func (client *Client) DeleteGroupUsers(ctx context.Context, groupID string, user
 	variables := newVars(
 		gqlID(groupID),
 		gqlIDs(userIDs, "removedUserIds"),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.UpdateGroupRemoveUsers{}
diff --git a/twingate/internal/client/query/group-read.go b/twingate/internal/client/query/group-read.go
index a44138ee..bb37787c 100644
--- a/twingate/internal/client/query/group-read.go
+++ b/twingate/internal/client/query/group-read.go
@@ -13,7 +13,7 @@ type gqlGroup struct {
 	IDName
 	IsActive       bool
 	Type           string
-	Users          Users
+	Users          Users `graphql:"users(after: $usersEndCursor)"`
 	SecurityPolicy gqlSecurityPolicy
 }
 
diff --git a/twingate/internal/client/resource.go b/twingate/internal/client/resource.go
index dafa2da5..ff92a788 100644
--- a/twingate/internal/client/resource.go
+++ b/twingate/internal/client/resource.go
@@ -70,6 +70,7 @@ func (client *Client) CreateResource(ctx context.Context, input *model.Resource)
 		gqlNullable(input.IsVisible, "isVisible"),
 		gqlNullable(input.IsBrowserShortcutEnabled, "isBrowserShortcutEnabled"),
 		gqlNullable(input.Alias, "alias"),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.CreateResource{}
@@ -100,7 +101,10 @@ func (client *Client) ReadResource(ctx context.Context, resourceID string) (*mod
 		return nil, opr.apiError(ErrGraphqlIDIsEmpty)
 	}
 
-	variables := newVars(gqlID(resourceID))
+	variables := newVars(
+		gqlID(resourceID),
+		gqlNullable("", query.CursorUsers),
+	)
 
 	response := query.ReadResource{}
 	if err := client.query(ctx, &response, variables, opr, attr{id: resourceID}); err != nil {
@@ -171,6 +175,7 @@ func (client *Client) UpdateResource(ctx context.Context, input *model.Resource)
 		gqlNullable(input.IsVisible, "isVisible"),
 		gqlNullable(input.IsBrowserShortcutEnabled, "isBrowserShortcutEnabled"),
 		gqlNullable(input.Alias, "alias"),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.UpdateResource{}
@@ -312,6 +317,7 @@ func (client *Client) DeleteResourceGroups(ctx context.Context, resourceID strin
 	variables := newVars(
 		gqlID(resourceID),
 		gqlIDs(deleteGroupIDs, "removedGroupIds"),
+		gqlNullable("", query.CursorUsers),
 	)
 
 	response := query.UpdateResourceRemoveGroups{}