diff --git a/cloud/__init__.py b/cloud/__init__.py
index db7b79d..daa64dd 100644
--- a/cloud/__init__.py
+++ b/cloud/__init__.py
@@ -111,8 +111,8 @@ class CloudExtension(PillarExtension):
         # Avoid infinite loops while we're changing the user's roles.
         service.signal_user_changed_role.disconnect(self._user_changed_role)
         try:
-            for role in linked_roles:
-                service.do_badger(action, role, user_id=user['_id'])
+            if linked_roles:
+                service.do_badger(action, roles=linked_roles, user_id=user['_id'])
         finally:
             service.signal_user_changed_role.connect(self._user_changed_role)
 
diff --git a/cloud/cli.py b/cloud/cli.py
index e94342c..ed450a7 100644
--- a/cloud/cli.py
+++ b/cloud/cli.py
@@ -71,7 +71,7 @@ def reconcile_subscribers():
                 action = 'grant'
 
             with lock:
-                service.do_badger(action, 'subscriber', user_id=user['_id'])
+                service.do_badger(action, role='subscriber', user_id=user['_id'])
 
     with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
         future_to_user = {executor.submit(do_user, idx, user): user