diff --git a/lib/entitlements/backend/github_org/provider.rb b/lib/entitlements/backend/github_org/provider.rb
index 7f5de3b..8443f7b 100644
--- a/lib/entitlements/backend/github_org/provider.rb
+++ b/lib/entitlements/backend/github_org/provider.rb
@@ -104,7 +104,8 @@ def role_name(role_identifier)
         # Returns an Entitlements::Models::Group object.
         Contract String => Entitlements::Models::Group
         def role_to_group(role)
-          members = github.org_members.keys.select { |username| github.org_members[username] == role }
+          org_members = github.org_members
+          members = org_members.select { |_, member_role| member_role == role }.keys
           Entitlements::Models::Group.new(
             dn: role_dn(role),
             members: Set.new(members),
diff --git a/spec/unit/entitlements/backend/github_org/provider_spec.rb b/spec/unit/entitlements/backend/github_org/provider_spec.rb
index b0e91f3..e5054d6 100644
--- a/spec/unit/entitlements/backend/github_org/provider_spec.rb
+++ b/spec/unit/entitlements/backend/github_org/provider_spec.rb
@@ -34,7 +34,7 @@
 
     it "pulls the role name from the distinguished name" do
       allow(subject).to receive(:github).and_return(github)
-      allow(github).to receive(:org_members).and_return(members_and_roles)
+      expect(github).to receive(:org_members).once.and_return(members_and_roles)
       result = subject.read("member")
       expect(result).to be_a_kind_of(Entitlements::Models::Group)
       expect(result.member_strings).to eq(member_strings_set)