diff --git a/.github/workflows/CDA-testing.yml b/.github/workflows/CDA-testing.yml
index d208f5c..8667763 100644
--- a/.github/workflows/CDA-testing.yml
+++ b/.github/workflows/CDA-testing.yml
@@ -1,10 +1,8 @@
-name: CI
+name: CDA integration
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+  schedule:
+    - cron: '17 8 * * *'
   workflow_dispatch:
 
 jobs:
@@ -18,7 +16,7 @@ jobs:
       fail-fast: false
       max-parallel: 6
       matrix:
-        python-version: ['3.9', '3.13']
+        python-version: ['3.9', '3.x']
         # Keep the release pins in sync with the environments (see CONTRIBUTING.md).
         cda:
           - name: latest
@@ -78,16 +76,14 @@ jobs:
           key: ${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-poetry-${{
             hashFiles('poetry.lock') }}
 
-      # Install dependencies only if cache is missed
       - name: Install dependencies
-        if: steps.cache-poetry-venv.outputs.cache-hit != 'true'
+        env:
+          POETRY_INSTALLER_ONLY_BINARY: ':all:'
         run: poetry install --no-root
 
       # Run pytest and generate coverage report data.
-      - name: Run Tests and Check Types
-        run: |
-          poetry run pytest tests/cda/ --doctest-modules --cov --cov-report=xml:out/coverage.xml
-          poetry run mypy --strict cwms/
+      - name: Run Tests
+        run: poetry run pytest tests/cda/ --doctest-modules --cov --cov-report=xml:out/coverage.xml
 
       - name: Generate Coverage Report
         uses: irongut/CodeCoverageSummary@v1.3.0
diff --git a/.github/workflows/code-check.yml b/.github/workflows/code-check.yml
index 306f94f..1ff93b4 100644
--- a/.github/workflows/code-check.yml
+++ b/.github/workflows/code-check.yml
@@ -1,7 +1,14 @@
 name: Code Check
 
-# Run the workflow on all branches.
-on: [push, pull_request]
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: code-check-${{ github.event_name }}-${{ github.event.pull_request.number
+    || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # Run basic code quality checks.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 33b3e58..0ae964f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,10 +4,14 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   schedule:
     - cron: '0 0 * * 0'
 
+concurrency:
+  group: codeql-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref
+    }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/pypi-deploy.yml b/.github/workflows/pypi-deploy.yml
index 7a7c6ea..7539afe 100644
--- a/.github/workflows/pypi-deploy.yml
+++ b/.github/workflows/pypi-deploy.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Set Up Python
         uses: actions/setup-python@v7
         with:
-          python-version: '3.13'
+          python-version: '3.x'
       - name: Install Poetry
         uses: abatilo/actions-poetry@v4
       - name: Install Dependencies
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index 1d42047..45e1608 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -1,7 +1,15 @@
 name: Testing
 
-# Run the workflow on all branches.
-on: [push, pull_request]
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: testing-${{ github.event_name }}-${{ github.event.pull_request.number ||
+    github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # Run tests and generate code coverage report.
@@ -11,7 +19,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.9', '3.13', '3.14']
+        python-version: ['3.9', '3.x']
 
     steps:
       - uses: actions/checkout@v7
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3c1029d..7e130dd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -190,6 +190,40 @@ subject before merging; Release Please reads commits on `main`, not PR titles
 directly. With other merge methods, preserve Conventional Commit messages in the
 merged commits.
 
+### CI coverage
+
+Unit tests and strict type checks run on Python **3.9** and **latest stable**
+(`3.x`) for PRs targeting any branch and pushes to `main`. Formatting and CodeQL
+also run on PRs and main. Feature-branch pushes do not start duplicate checks;
+new PR commits cancel superseded runs. Draft and documentation-only PRs use the
+same straightforward checks as other PRs.
+
+The **CDA integration** workflow runs the full 18-job matrix nightly at 08:17 UTC:
+two Python versions, three CDA versions, and three schema versions. It does not
+run automatically on PRs or merges. Integration failures can therefore surface
+after merge.
+
+**Before approving a PR that could affect CDA integration**, run the full matrix
+against the PR's head branch and review the results. You can also run it anytime
+you want to check a branch. From this repository, use:
+
+```sh
+gh workflow run CDA-testing.yml --ref <branch>
+```
+
+Replace `<branch>` with the branch name on GitHub. Alternatively, use **Actions >
+CDA integration > Run workflow** and select the branch. Starting the workflow
+does not mean the tests passed; check the completed run in Actions before approving.
+Inspect failed combinations and backend logs, reproduce using the Compose
+overrides above, and fix the cause rather than dropping failing combinations.
+
+Release publishing still tests the exact tag on latest stable Python, verifies
+the package version, and builds before publishing. CodeQL retains its weekly run.
+Repository administrators should require the two unit-test checks, formatting,
+and CodeQL (plus existing external requirements). Nightly CDA checks must not be
+required on PRs because they do not run there. These workflow changes do not
+modify repository merge rules.
+
 ### Release flow
 
 1. Merge reviewed changes into `main`.