diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index f1fd0cd5..f47d2755 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: android-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml
index 6e1288ad..dd32ccb4 100644
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: appimage-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 7e639df7..13be2753 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: emscripten-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/latex.yml b/.github/workflows/latex.yml
index 7a0f9474..731d2b44 100644
--- a/.github/workflows/latex.yml
+++ b/.github/workflows/latex.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: latex-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-manual:
 
diff --git a/.github/workflows/linux-cli.yml b/.github/workflows/linux-cli.yml
index 9479a5df..0d13781e 100644
--- a/.github/workflows/linux-cli.yml
+++ b/.github/workflows/linux-cli.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-cli-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 96af2619..5e61f141 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 9cb0e040..900ec107 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: macos-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index c4398a22..b2bcd46b 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: mingw-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7ac98e6f..5a6b1395 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
   release-build-windows:
     uses: ./.github/workflows/windows.yml
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 557dc180..2a97a8b7 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache