diff --git a/.github/workflows/check_amalgamation.yml b/.github/workflows/check_amalgamation.yml
index f692e434a..670269cbb 100644
--- a/.github/workflows/check_amalgamation.yml
+++ b/.github/workflows/check_amalgamation.yml
@@ -3,6 +3,10 @@ name: "Check amalgamation"
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 2e50fee9c..9398fdbaf 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,6 +1,10 @@
 name: CIFuzz
 on: [pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index aa09008a3..2052c1d35 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -9,6 +9,10 @@
 name: 'Dependency Review'
 on: [pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/flawfinder.yml b/.github/workflows/flawfinder.yml
index 2c8befd40..753b81e0d 100644
--- a/.github/workflows/flawfinder.yml
+++ b/.github/workflows/flawfinder.yml
@@ -5,6 +5,10 @@
 
 name: flawfinder
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 3b4571b95..a93c86ae2 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -4,6 +4,12 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
+# pull_request_target runs on the base branch, so github.ref would put all pull
+# requests into one group; group by pull request number instead
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 113da079a..96f87526a 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -14,6 +14,10 @@ on:
   push:
     branches: ["develop"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index dc326db55..922c9ca86 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -19,6 +19,10 @@ on:
   schedule:
     - cron: '23 2 * * 4'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read