diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c29b1ea..de1c84b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,12 @@ on:
 permissions:
   contents: read
 
+# Only newer first-attempt PR validation supersedes an older PR run.
+# Keep main pushes and manual reruns isolated, even when rerunning an old PR head.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && format('pr-{0}', github.event.pull_request.number) || format('run-{0}-attempt-{1}', github.run_id, github.run_attempt) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == 1 }}
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/managed-sessions.yml b/.github/workflows/managed-sessions.yml
index f3124b2..b880c48 100644
--- a/.github/workflows/managed-sessions.yml
+++ b/.github/workflows/managed-sessions.yml
@@ -8,6 +8,12 @@ on:
 permissions:
   contents: read
 
+# Only newer first-attempt PR validation supersedes an older PR run.
+# Keep main pushes and manual reruns isolated, even when rerunning an old PR head.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && format('pr-{0}', github.event.pull_request.number) || format('run-{0}-attempt-{1}', github.run_id, github.run_attempt) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == 1 }}
+
 jobs:
   runtime:
     strategy: