diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0377eca..13a677b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,8 +16,20 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# On a branch the newest push is the only one that matters, so cancel the rest.
+#
+# On main the group is keyed per COMMIT. A commit cancelling a DIFFERENT
+# commit's run breaks deployment, because every deploy path keys off that run:
+# one that waits for CI to pass on the commit finds a cancelled run and stops,
+# and one chained on `workflow_run` sees conclusion=cancelled and skips.
+# auto-merge also re-arms CI with a dispatch, which under a single
+# group-per-branch cancels the push run for the SAME commit.
+#
+# Measured 2026-09-11 across the fleet: 28 of 39 ci.yml files had this shape.
+# fleetcrown stranded four merges silently (main green, nothing red, the box
+# serving the previous build); hirnli failed its deploy loudly at the wait step.
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ci-${{ github.ref }}-${{ github.ref == 'refs/heads/main' && github.sha || 'branch' }}
   cancel-in-progress: true
 
 jobs: