diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
index f5b1f8f12..194439241 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -24,6 +24,9 @@ name: "ASF Allowlist Check"
     paths: [".github/**"]
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   asf-allowlist-check:
     runs-on: ubuntu-slim
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index add6aea6b..029fb066f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: "Analyze (${{ matrix.language }})"
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index e8fe8ec7b..b06fcdeea 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   prek:
     # Two shapes of the same job, split by event.
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index 600677aa0..26fb313ea 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -29,6 +29,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 # Apache RAT (Release Audit Tool) verifies every source file carries an
 # approved licence header — the same check ASF Infra runs on release
 # artefacts, run here on every PR so header drift is caught before merge.
diff --git a/.github/workflows/sandbox-lint.yml b/.github/workflows/sandbox-lint.yml
index 95fb36616..0c1173626 100644
--- a/.github/workflows/sandbox-lint.yml
+++ b/.github/workflows/sandbox-lint.yml
@@ -41,6 +41,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   sandbox-lint:
     name: lint .claude/settings.json against baseline
diff --git a/.github/workflows/skill-and-tool-validator.yml b/.github/workflows/skill-and-tool-validator.yml
index 71d064ffb..dcbc04f6d 100644
--- a/.github/workflows/skill-and-tool-validator.yml
+++ b/.github/workflows/skill-and-tool-validator.yml
@@ -35,6 +35,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   skill-and-tool-validator:
     name: validate skills and tool contracts
diff --git a/.github/workflows/skill-token-count.yml b/.github/workflows/skill-token-count.yml
index cb7368634..8a10951f3 100644
--- a/.github/workflows/skill-token-count.yml
+++ b/.github/workflows/skill-token-count.yml
@@ -42,6 +42,9 @@ on:
     branches: [main]
     paths: *measurement_paths
 permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   measure:
     runs-on: ubuntu-slim
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fba4f789e..f8b494562 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Discover workspace members from the root pyproject.toml so the
   # pytest matrix below is data-driven — adding a new tool is a
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index dc7949855..bcc371742 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -33,6 +33,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   zizmor:
     name: "zizmor"