diff --git a/core/auth_backends.py b/core/auth_backends.py
index 8a3087e6..7d6fd76c 100644
--- a/core/auth_backends.py
+++ b/core/auth_backends.py
@@ -29,9 +29,14 @@ class SithModelBackend(ModelBackend):
     """
 
     def _get_group_permissions(self, user_obj: User):
-        groups = user_obj.groups.all()
+        # union of querysets doesn't work if the queryset is ordered.
+        # The empty `order_by` here are actually there to *remove*
+        # any default ordering defined in managers or model Meta
+        groups = user_obj.groups.order_by()
         if user_obj.is_subscribed:
             groups = groups.union(
-                Group.objects.get(pk=settings.SITH_GROUP_SUBSCRIBERS_ID)
+                Group.objects.filter(pk=settings.SITH_GROUP_SUBSCRIBERS_ID).order_by()
             )
-        return Permission.objects.filter(group__group__in=groups)
+        return Permission.objects.filter(
+            group__group__in=groups.values_list("pk", flat=True)
+        )