diff --git a/.github/workflows/prek.yml b/.github/workflows/prek.yml
index 135aaed..ff5e35e 100644
--- a/.github/workflows/prek.yml
+++ b/.github/workflows/prek.yml
@@ -4,6 +4,7 @@ on: [push, pull_request]
 jobs:
   prek:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7.0.1
       - uses: j178/prek-action@v2.0.3
diff --git a/.github/workflows/python-docs.yml b/.github/workflows/python-docs.yml
index 4fab058..9bd5458 100644
--- a/.github/workflows/python-docs.yml
+++ b/.github/workflows/python-docs.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   docs:
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || !github.event.pull_request.draft
+    timeout-minutes: 15
     steps:
       - name: Check out repository
         uses: actions/checkout@v7.0.1
@@ -21,9 +21,10 @@ jobs:
         id: setup-uv
         uses: astral-sh/setup-uv@v9.0.0
         with:
-          version: latest
+          version: "0.12.1"
           python-version: "3.14"
           enable-cache: true
+          prune-cache: true
 
       - name: Install project
         run: uv sync --all-extras --dev
@@ -34,7 +35,9 @@ jobs:
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v4.1.0
-        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }}
+        # Publish only from master. workflow_dispatch can be started on any
+        # branch, so gate on the ref rather than on the event.
+        if: ${{ github.ref == 'refs/heads/master' }}
         with:
           publish_branch: gh-pages
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 0a3080c..75751fc 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -11,6 +11,7 @@ permissions:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: github.event_name == 'release'
     steps:
     - name: Check out repository
@@ -29,9 +30,10 @@ jobs:
       id: setup-uv
       uses: astral-sh/setup-uv@v9.0.0
       with:
-        version: latest
+        version: "0.12.1"
         python-version: "3.14"
         enable-cache: true
+        prune-cache: true
 
     - name: Install project
       run: uv sync --all-extras --dev
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 7fc77f8..730156e 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -18,10 +18,12 @@ permissions:
 jobs:
   run:
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
         python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     steps:
       - name: Check out repository
         uses: actions/checkout@v7.0.1
@@ -64,9 +66,10 @@ jobs:
         id: setup-uv
         uses: astral-sh/setup-uv@v9.0.0
         with:
-          version: latest
+          version: "0.12.1"
           python-version: ${{ matrix.python-version }}
           enable-cache: true
+          prune-cache: true
 
       - name: Install project
         run: uv sync --all-extras --dev
@@ -77,7 +80,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v6.0.0
-        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }}
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' || github.event_name == 'pull_request' }}
         with:
           env_vars: OS,PYTHON
           files: ./coverage.xml
@@ -94,7 +97,9 @@ jobs:
   runtime-import:
     name: Runtime-only import smoke test
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
+      fail-fast: false
       matrix:
         python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
     steps:
@@ -104,9 +109,10 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v9.0.0
         with:
-          version: latest
+          version: "0.12.1"
           python-version: ${{ matrix.python-version }}
           enable-cache: true
+          prune-cache: true
 
       - name: Import pymkv without dev dependencies
         run: uv run --no-dev python -c "import pymkv"