diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 91124d5..f25ff1b 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -21,6 +21,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Audits the ref that triggered the event (dependency changes on push / PR).
   audit:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 994c69e..1dcb4b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   fmt:
     name: rustfmt – check
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9ca93c3..7056c08 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -55,6 +55,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
diff --git a/.github/workflows/dse-check.yml b/.github/workflows/dse-check.yml
index daeab27..99f98c2 100644
--- a/.github/workflows/dse-check.yml
+++ b/.github/workflows/dse-check.yml
@@ -35,6 +35,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   dse-check:
     name: DSE - volatile zero-store survival (${{ matrix.os }}, ${{ matrix.toolchain }})
diff --git a/.github/workflows/fuzz-quick.yml b/.github/workflows/fuzz-quick.yml
index bc5c9de..08f85a1 100644
--- a/.github/workflows/fuzz-quick.yml
+++ b/.github/workflows/fuzz-quick.yml
@@ -23,6 +23,13 @@ on:
       - ".github/workflows/fuzz-quick.yml"
   workflow_dispatch: # manual trigger when you need a long run
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   fuzz:
     runs-on: ubuntu-latest