diff --git a/src/auth/db.py b/src/auth/db.py
index 54a10df..426c969 100644
--- a/src/auth/db.py
+++ b/src/auth/db.py
@@ -148,6 +148,14 @@ def get_user_by_id(user_id: int) -> sqlite3.Row | None:
     return get_conn().execute("SELECT * FROM users WHERE id = ?", (user_id,)).fetchone()
 
 
+def list_users(limit: int = 1000) -> list[sqlite3.Row]:
+    return (
+        get_conn()
+        .execute("SELECT * FROM users ORDER BY created_at DESC LIMIT ?", (limit,))
+        .fetchall()
+    )
+
+
 def set_email_verified(user_id: int) -> None:
     get_conn().execute(
         "UPDATE users SET email_verified = 1, updated_at = ? WHERE id = ?",
diff --git a/tests/auth/test_db.py b/tests/auth/test_db.py
index 0d321b7..2a53a8e 100644
--- a/tests/auth/test_db.py
+++ b/tests/auth/test_db.py
@@ -202,3 +202,27 @@ def test_promote_pending_email_noop_when_empty(users_db_path):
     uid = db.create_user("a@b.c", generate_password_hash("password12"))
     assert db.promote_pending_email(uid) is None
     assert db.get_user_by_id(uid)["email"] == "a@b.c"
+
+
+def test_list_users_orders_by_created_at_desc(users_db_path):
+    from src.auth import db
+
+    db.init_schema()
+    db.create_user("first@ex.fr", "hash")
+    db.create_user("second@ex.fr", "hash")
+
+    rows = db.list_users()
+
+    assert [r["email"] for r in rows] == ["second@ex.fr", "first@ex.fr"]
+
+
+def test_list_users_respects_limit(users_db_path):
+    from src.auth import db
+
+    db.init_schema()
+    for i in range(3):
+        db.create_user(f"user{i}@ex.fr", "hash")
+
+    rows = db.list_users(limit=2)
+
+    assert len(rows) == 2