diff --git a/src/lib/server/keycloak/index.ts b/src/lib/server/keycloak/index.ts
index 2981e0e0e..5536f70e7 100644
--- a/src/lib/server/keycloak/index.ts
+++ b/src/lib/server/keycloak/index.ts
@@ -186,7 +186,7 @@ async function updateEmails(prisma: PrismaClient) {
   if (currentUserEmail.size === 0) return;
 
   const userEmails = await getManyUserEmails(currentUserEmail);
-  console.log(`updating ${userEmails.size} emails`);
+  console.log(`[${new Date().toISOString()}] updating ${userEmails.size}`);
 
   for (const [studentId, email] of userEmails) {
     await prisma.member.update({
@@ -211,13 +211,14 @@ async function getManyUserEmails(
   const userEmails = new Map<string, string>();
 
   (await client.users.find({ username: "" })).forEach((user) => {
+    const { username, email } = user;
+    if (!username || !email) return;
+
     if (
-      user.email !== undefined && // if keycloak has an email for the user
-      user.username !== undefined && // if keycloak has a username for the user
-      currentUserEmail.has(user.username) && // if we have the user in our database
-      currentUserEmail.get(user.username) !== user.email // if the email has changed
+      currentUserEmail.has(username) && // if the user exists in our database
+      currentUserEmail.get(username) !== user.email // if the email has changed
     ) {
-      userEmails.set(user.username, user.email);
+      userEmails.set(username, email);
     }
   });
   return userEmails;
diff --git a/src/routes/(app)/admin/debug/+page.server.ts b/src/routes/(app)/admin/debug/+page.server.ts
index 5ab1537ad..c17c58a5a 100644
--- a/src/routes/(app)/admin/debug/+page.server.ts
+++ b/src/routes/(app)/admin/debug/+page.server.ts
@@ -1,4 +1,6 @@
 import { env } from "$env/dynamic/private";
+import keycloak from "$lib/server/keycloak";
+import authorizedPrismaClient from "$lib/server/shop/authorizedPrisma";
 import { isNollningPeriod } from "$lib/utils/adminSettings/nollning";
 
 export const load = async () => {
@@ -7,3 +9,9 @@ export const load = async () => {
     prismaLogLevel: env.PRISMA_LOG_LEVEL,
   };
 };
+
+export const actions = {
+  keycloakSync: async () => {
+    keycloak.sync(authorizedPrismaClient);
+  },
+};
diff --git a/src/routes/(app)/admin/debug/+page.svelte b/src/routes/(app)/admin/debug/+page.svelte
index 03bdcb8ed..7737213cf 100644
--- a/src/routes/(app)/admin/debug/+page.svelte
+++ b/src/routes/(app)/admin/debug/+page.svelte
@@ -1,11 +1,22 @@
 <script lang="ts">
   import { version } from "$app/environment";
+  import { isAuthorized } from "$lib/utils/authorization";
 
   export let data;
   $: user = data.user;
   $: policies = user.policies.toSorted();
 </script>
 
+{#if isAuthorized("core:admin")}
+  <section class="mb-4">
+    <h1 class="mb-2 text-lg font-semibold">Actions</h1>
+    <form action="?/keycloakSync" method="POST" class="flex items-center gap-4">
+      <button type="submit" class="btn">Sync with Keycloak</button>
+      <p>This will push mandates and pull email addresses.</p>
+    </form>
+  </section>
+{/if}
+
 <section>
   <h1 class="text-lg font-semibold">Metadata</h1>
   <ul class="ml-4 list-disc">