diff --git a/app/Http/Controllers/UsersController.php b/app/Http/Controllers/UsersController.php
index 3bce98c..ebb6e23 100644
--- a/app/Http/Controllers/UsersController.php
+++ b/app/Http/Controllers/UsersController.php
@@ -12,6 +12,11 @@ class UsersController extends Controller
         return $user;
     }
 
+    public function leaderboard()
+    {
+        return User::orderBy('xp', 'desc')->get();
+    }
+
     public function updateAvatar(Request $request, User $user)
     {
         if ($request->user()->id !== $user->id) {
diff --git a/app/Models/User.php b/app/Models/User.php
index 5eab1d1..29d4984 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -14,7 +14,7 @@ use Laravel\Sanctum\HasApiTokens;
 class User extends Authenticatable
 {
     /** @use HasFactory<\Database\Factories\UserFactory> */
-    use HasApiTokens, Notifiable, SoftDeletes;
+    use HasApiTokens, HasFactory, Notifiable, SoftDeletes;
 
     /**
      * The attributes that are mass assignable.
diff --git a/routes/api.php b/routes/api.php
index 1869f36..30b85ad 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -34,6 +34,7 @@ Route::middleware(['auth:sanctum', EnsureUserIsOrga::class])->group(function ()
 // Auth middleware
 Route::middleware('auth:sanctum')->group(function (): void {
     // User
+    Route::get('users/leaderboard', [UsersController::class, 'leaderboard']);
     Route::get('users/{user}', [UsersController::class, 'show']);
     Route::post('users/{user}/avatar', [UsersController::class, 'updateAvatar']);
     Route::post('hunts/{hunt}/participate', [HuntsController::class, 'participate']);
diff --git a/tests/Feature/LeaderboardTest.php b/tests/Feature/LeaderboardTest.php
new file mode 100644
index 0000000..3e446e9
--- /dev/null
+++ b/tests/Feature/LeaderboardTest.php
@@ -0,0 +1,31 @@
+<?php
+
+use App\Models\User;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+test('leaderboard endpoint returns users sorted by xp in descending order', function () {
+    // Create users with different XP
+    $user1 = User::factory()->create(['xp' => 100, 'username' => 'User1']);
+    $user2 = User::factory()->create(['xp' => 300, 'username' => 'User2']);
+    $user3 = User::factory()->create(['xp' => 200, 'username' => 'User3']);
+
+    // Authenticate as one of the users
+    $this->actingAs($user1);
+
+    // Call the endpoint
+    $response = $this->getJson('/api/users/leaderboard');
+
+    // Assert response status
+    $response->assertOk();
+
+    // Assert the order of users in the response
+    $response->assertJson(fn ($json) => 
+        $json->has(3)
+             ->where('0.id', $user2->id) // 300 XP
+             ->where('1.id', $user3->id) // 200 XP
+             ->where('2.id', $user1->id) // 100 XP
+    );
+});