diff --git a/internal/keycloak/groups.go b/internal/keycloak/groups.go
index f68f35f7..90c1b44e 100644
--- a/internal/keycloak/groups.go
+++ b/internal/keycloak/groups.go
@@ -55,15 +55,14 @@ func (c *Client) rawGroups(ctx context.Context) ([]byte, error) {
 func (c *Client) GroupNameGroupIDMap(
 	ctx context.Context,
 ) (map[string]string, error) {
-	// rate limit keycloak API access
-	if err := c.limiter.Wait(ctx); err != nil {
-		return nil, fmt.Errorf("couldn't wait for limiter: %v", err)
-	}
 	// prefer to use cached value
 	if groupNameGroupIDMap, ok := c.groupCache.Get(); ok {
 		return groupNameGroupIDMap, nil
 	}
 	// otherwise get data from keycloak
+	if err := c.limiter.Wait(ctx); err != nil {
+		return nil, fmt.Errorf("couldn't wait for limiter: %v", err)
+	}
 	data, err := c.rawGroups(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("couldn't get groups from Keycloak API: %v", err)