diff --git a/server/api/controllers/cards/index.js b/server/api/controllers/cards/index.js
index 8e19d51d..e01ad7b6 100644
--- a/server/api/controllers/cards/index.js
+++ b/server/api/controllers/cards/index.js
@@ -243,8 +243,17 @@ module.exports = {
       filterLabelIds = filterLabelIds.filter((labelId) => availableLabelIdsSet.has(labelId));
     }
 
+    // ISO 8601 allows forms Postgres rejects as a timestamp (`2026`, `2026-W35-3`,
+    // a comma as the decimal separator), so the cursor is normalized here rather
+    // than reaching the query as the string the client sent. It stays a string
+    // because the equality branch of the cursor reads a `Date` as an empty constraint
+    const before = inputs.before && {
+      listChangedAt: moment.utc(inputs.before.listChangedAt, moment.ISO_8601, true).toISOString(),
+      id: inputs.before.id,
+    };
+
     const cards = await Card.qm.getByEndlessListId(list.id, {
-      before: inputs.before,
+      before,
       search: inputs.search,
       userIds: filterUserIds,
       labelIds: filterLabelIds,
diff --git a/server/api/hooks/query-methods/models/Card.js b/server/api/hooks/query-methods/models/Card.js
index cefb45ef..0dd7a6c2 100644
--- a/server/api/hooks/query-methods/models/Card.js
+++ b/server/api/hooks/query-methods/models/Card.js
@@ -108,6 +108,9 @@ const getByEndlessListId = async (listId, { before, search, userIds, labelIds })
       query += ` AND card_label.label_id IN (${inValues.join(', ')})`;
     }
 
+    // Must match the cursor built from the last returned card, otherwise the
+    // limit cuts an arbitrary slice and pages skip or repeat cards
+    query += ' ORDER BY card.list_changed_at DESC, card.id DESC';
     query += ` LIMIT ${LIMIT}`;
 
     let queryResult;