diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6ce181a1..754324fd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,6 +20,11 @@ on:
     - cron: '20 2 * * 2'
   workflow_dispatch:
 
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -29,6 +34,7 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: 120
     permissions:
       # required for all workflows
       security-events: write
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index f5234336..cd8823d0 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -12,6 +12,11 @@ on:
   pull_request:
     branches: [ "main" ]
 
+# Cancel superseded runs for the same PR to save runner minutes.
+concurrency:
+  group: dependency-review-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 # If using a dependency submission action in this workflow this permission will need to be set to:
 #
 # permissions:
@@ -26,6 +31,7 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: 'Checkout repository'
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
diff --git a/.github/workflows/maven-central-release.yml b/.github/workflows/maven-central-release.yml
index aa113c30..dab0d2fe 100644
--- a/.github/workflows/maven-central-release.yml
+++ b/.github/workflows/maven-central-release.yml
@@ -14,9 +14,16 @@ on:
         required: true
         type: string
 
+# Serialize releases: never run two release jobs at once, and never cancel an
+# in-progress release (cancelling mid-deploy could leave a partial publish).
+concurrency:
+  group: maven-central-release
+  cancel-in-progress: false
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
       # Needed to open the version-bump pull request instead of pushing to main.
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 82149808..9daaae08 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -16,10 +16,16 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: maven-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       pull-requests: write