diff --git a/go.mod b/go.mod
index 7aae15d2..eed54810 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/conductorone/baton-github-enterprise
 go 1.25.2
 
 require (
-	github.com/conductorone/baton-github v0.2.13
+	github.com/conductorone/baton-github v0.2.14
 	github.com/conductorone/baton-sdk v0.8.17
 	github.com/ennyjfrick/ruleguard-logfatal v0.0.2
 	github.com/quasilyte/go-ruleguard/dsl v0.3.23
diff --git a/go.sum b/go.sum
index 40b79755..e1855a91 100644
--- a/go.sum
+++ b/go.sum
@@ -62,8 +62,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/conductorone/baton-github v0.2.13 h1:LCnCKo54gr/Z5Nhx6fPQJk0cfXmfv0tImvXJI0Kr0kg=
-github.com/conductorone/baton-github v0.2.13/go.mod h1:qyVHJTc78i0iJmoIrCZkTUFENndRnm+3AVvzahX1Vzk=
+github.com/conductorone/baton-github v0.2.14 h1:cSOkEE0otWafT9umujg/5jXU4dnXJYDB0ruoDcdWUWU=
+github.com/conductorone/baton-github v0.2.14/go.mod h1:qyVHJTc78i0iJmoIrCZkTUFENndRnm+3AVvzahX1Vzk=
 github.com/conductorone/baton-sdk v0.8.17 h1:k++l6LV5uU4wmoP20mWFJcpgpgHCVrqZU/tbJ+sQ1dA=
 github.com/conductorone/baton-sdk v0.8.17/go.mod h1:agmFrml6APUw4ZlqMEBrnXYj3aAOGKOJ6gztiNj64h0=
 github.com/conductorone/dpop v0.2.3 h1:s91U3845GHQ6P6FWrdNr2SEOy1ES/jcFs1JtKSl2S+o=
diff --git a/vendor/github.com/conductorone/baton-github/pkg/connector/user.go b/vendor/github.com/conductorone/baton-github/pkg/connector/user.go
index d572e0a6..a67df7ba 100644
--- a/vendor/github.com/conductorone/baton-github/pkg/connector/user.go
+++ b/vendor/github.com/conductorone/baton-github/pkg/connector/user.go
@@ -108,15 +108,14 @@ const (
 )
 
 type userResourceType struct {
-	resourceType          *v2.ResourceType
-	client                *github.Client
-	graphqlClient         *githubv4.Client
-	samlStates            map[string]samlState // per-org SAML state, keyed by org name
-	enterpriseSAMLFetched bool                 // true after first page fetches and stores SAML data
-	orgCache              *orgNameCache
-	orgs                  []string
-	customClient          *customclient.Client
-	enterprises           []string
+	resourceType  *v2.ResourceType
+	client        *github.Client
+	graphqlClient *githubv4.Client
+	samlStates    map[string]samlState // per-org SAML state, keyed by org name
+	orgCache      *orgNameCache
+	orgs          []string
+	customClient  *customclient.Client
+	enterprises   []string
 }
 
 func (u *userResourceType) ResourceType(_ context.Context) *v2.ResourceType {
@@ -150,15 +149,20 @@ func (u *userResourceType) List(ctx context.Context, parentID *v2.ResourceId, op
 	// user loop can do plain map lookups with no session calls.
 	var enterpriseSAMLEmails map[string]string
 	if currentSAMLState == samlStateEnterprise {
-		if !u.enterpriseSAMLFetched {
+		_, alreadyFetched, err := session.GetJSON[[]string](ctx, opts.Session, enterpriseSAMLKeysIndex)
+		if err != nil {
+			return nil, nil, fmt.Errorf("baton-github: error checking enterprise SAML session: %w", err)
+		}
+		if !alreadyFetched {
 			if err := u.fetchAndStoreEnterpriseSAML(ctx, opts.Session); err != nil {
 				l.Debug("failed to fetch enterprise SAML emails, falling back to REST API emails",
 					zap.Error(err))
-				u.enterpriseSAMLFetched = true
+				// Write empty sentinel so we don't retry for remaining orgs in this sync
+				if setErr := session.SetJSON(ctx, opts.Session, enterpriseSAMLKeysIndex, []string{}); setErr != nil {
+					l.Debug("failed to write empty SAML sentinel to session", zap.Error(setErr))
+				}
 				u.samlStates[orgName] = samlStateDisabled
 				currentSAMLState = samlStateDisabled
-			} else {
-				u.enterpriseSAMLFetched = true
 			}
 		}
 		if currentSAMLState == samlStateEnterprise {
@@ -467,18 +471,20 @@ func (u *userResourceType) fetchAndStoreEnterpriseSAML(ctx context.Context, ss s
 		}
 	}
 
+	keys := make([]string, 0, len(samlByLogin))
+	for k := range samlByLogin {
+		keys = append(keys, k)
+	}
 	if len(samlByLogin) > 0 {
 		if err := session.SetManyJSON(ctx, ss, samlByLogin); err != nil {
 			return fmt.Errorf("baton-github: error storing enterprise SAML mappings: %w", err)
 		}
-
-		keys := make([]string, 0, len(samlByLogin))
-		for k := range samlByLogin {
-			keys = append(keys, k)
-		}
-		if err := session.SetJSON(ctx, ss, enterpriseSAMLKeysIndex, keys); err != nil {
-			return fmt.Errorf("baton-github: error storing enterprise SAML key index: %w", err)
-		}
+	}
+	// Always write the key index - its presence in the session tells future
+	// List() calls that we already fetched for this sync, even if zero
+	// SAML mappings were found.
+	if err := session.SetJSON(ctx, ss, enterpriseSAMLKeysIndex, keys); err != nil {
+		return fmt.Errorf("baton-github: error storing enterprise SAML key index: %w", err)
 	}
 
 	l.Debug("stored enterprise SAML mappings in session", zap.Int("count", len(samlByLogin)))
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0139f933..60cbf0b9 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -162,7 +162,7 @@ github.com/cenkalti/backoff/v5
 # github.com/cespare/xxhash/v2 v2.3.0
 ## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/conductorone/baton-github v0.2.13
+# github.com/conductorone/baton-github v0.2.14
 ## explicit; go 1.25.2
 github.com/conductorone/baton-github/pkg/config
 github.com/conductorone/baton-github/pkg/connector