diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7cb1fa..e85a516 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,12 @@ name: Tests
 # many).
 on: push
 
+# A newer push to the same ref supersedes the run in flight, so a burst of
+# pushes to a branch doesn't queue a full ubuntu + macOS matrix for each one.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml
index ff1face..64b3e9c 100644
--- a/.github/workflows/release-github.yml
+++ b/.github/workflows/release-github.yml
@@ -7,6 +7,12 @@ on:
         description: "Release tag (e.g. v0.2.0)"
         required: true
 
+# One release per tag at a time, and never cancelled: a half-built release
+# has to finish or fail on its own. A second dispatch for the same tag waits.
+concurrency:
+  group: release-github-${{ github.event.inputs.tag || github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
diff --git a/.github/workflows/release-mcp-registry.yml b/.github/workflows/release-mcp-registry.yml
index 860656c..a01d48d 100644
--- a/.github/workflows/release-mcp-registry.yml
+++ b/.github/workflows/release-mcp-registry.yml
@@ -7,6 +7,12 @@ on:
         description: "Release tag (e.g. v0.1.0)"
         required: true
 
+# One registry publish per tag at a time, and never cancelled: cancelling
+# `mcp-publisher` mid-publish could leave the listing half-updated.
+concurrency:
+  group: release-mcp-registry-${{ github.event.inputs.tag || github.ref }}
+  cancel-in-progress: false
+
 # OIDC is how we authenticate to the MCP Registry: the registry trusts a GitHub
 # Actions token issued for this repository, so no long-lived secret is needed.
 permissions: