diff --git a/.github/workflows/ai-core.yml b/.github/workflows/ai-core.yml
index a1814730..d5515307 100644
--- a/.github/workflows/ai-core.yml
+++ b/.github/workflows/ai-core.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: ai-core-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ai-core:
     timeout-minutes: 15
diff --git a/.github/workflows/atomic.yml b/.github/workflows/atomic.yml
index 8e8e1d20..537d387a 100644
--- a/.github/workflows/atomic.yml
+++ b/.github/workflows/atomic.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: atomic-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   atomic:
     timeout-minutes: 15
diff --git a/.github/workflows/audio.yml b/.github/workflows/audio.yml
index a488ce61..48572c5b 100644
--- a/.github/workflows/audio.yml
+++ b/.github/workflows/audio.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-audio-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-audio-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   lint:
@@ -31,6 +34,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-audio-lint
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-audio --check
       # Each feature on its own, so code that needs another feature fails here.
       - name: Clippy, each feature alone
@@ -67,6 +71,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-audio-msrv
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo +1.95.0 check -p craft-audio -p craft-media --all-features --locked
   features:
     timeout-minutes: 10
@@ -80,6 +85,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-audio-features
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo test -p craft-audio --no-default-features --features lossless-encode --locked
       - run: cargo test -p craft-audio --no-default-features --features pcm-encode --locked --lib
       - run: cargo test -p craft-audio --no-default-features --features flac-encode --locked --lib
@@ -98,6 +104,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-audio-test
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Build tests while installing ffmpeg
         run: |
           # The man-db index rebuild after dpkg is slow on hosted runners.
diff --git a/.github/workflows/crw.yml b/.github/workflows/crw.yml
index b1eac4f3..5799680b 100644
--- a/.github/workflows/crw.yml
+++ b/.github/workflows/crw.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-crw-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-crw-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   native:
@@ -34,6 +37,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-crw-${{ matrix.os }}
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-crw --check
       - run: cargo clippy -p craft-crw --all-targets --locked -- -D warnings
       - run: cargo test -p craft-crw --locked
@@ -52,6 +56,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-crw-wasm
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo check -p craft-crw --locked --target wasm32-unknown-unknown
 
   samples:
@@ -66,6 +71,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-crw-samples
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Cache the CC0 sample files
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
diff --git a/.github/workflows/dialogs.yml b/.github/workflows/dialogs.yml
index f5620999..0ef1d359 100644
--- a/.github/workflows/dialogs.yml
+++ b/.github/workflows/dialogs.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: dialogs-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   dialogs:
     timeout-minutes: 15
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 801743f1..d43bfc73 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: doc-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   doc:
     timeout-minutes: 15
diff --git a/.github/workflows/docpath.yml b/.github/workflows/docpath.yml
index 5192ade9..c959904f 100644
--- a/.github/workflows/docpath.yml
+++ b/.github/workflows/docpath.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: docpath-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   docpath:
     timeout-minutes: 15
diff --git a/.github/workflows/ecproj-format.yml b/.github/workflows/ecproj-format.yml
index bd01cbfa..f135a775 100644
--- a/.github/workflows/ecproj-format.yml
+++ b/.github/workflows/ecproj-format.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: ecproj-format-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ecproj-format:
     timeout-minutes: 15
diff --git a/.github/workflows/font-store.yml b/.github/workflows/font-store.yml
index e20e1565..6f24b733 100644
--- a/.github/workflows/font-store.yml
+++ b/.github/workflows/font-store.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: font-store-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   font-store:
     timeout-minutes: 20
diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml
index adb4208b..1748e324 100644
--- a/.github/workflows/i18n.yml
+++ b/.github/workflows/i18n.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: i18n-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   i18n:
     timeout-minutes: 15
diff --git a/.github/workflows/jpeg.yml b/.github/workflows/jpeg.yml
index d10c2598..0ecbb628 100644
--- a/.github/workflows/jpeg.yml
+++ b/.github/workflows/jpeg.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-jpeg-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-jpeg-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   check:
@@ -21,7 +24,7 @@ jobs:
     name: JPEG lint, tests, WASM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
@@ -31,6 +34,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-jpeg
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-jpeg --check
       - run: cargo clippy -p craft-jpeg --all-targets --locked -- -D warnings
       - run: cargo test -p craft-jpeg --locked
diff --git a/.github/workflows/keymap.yml b/.github/workflows/keymap.yml
index db25d0dd..821c3f1f 100644
--- a/.github/workflows/keymap.yml
+++ b/.github/workflows/keymap.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: keymap-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: keymap-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   linux:
@@ -27,7 +30,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Checkout test fonts
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: b076417b5880bd4154bd22f00695b1d28c6bea83
@@ -39,6 +42,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-keymap-linux
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-keymap --check
       - run: cargo clippy -p craft-keymap --all-targets --no-default-features --locked -- -D warnings
       # `snapshot` covers `ui` and `egui` and compiles the dialog screenshots, which need a GPU
@@ -65,7 +69,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Checkout test fonts
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: b076417b5880bd4154bd22f00695b1d28c6bea83
@@ -75,6 +79,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-keymap-${{ matrix.os }}
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo test -p craft-keymap --features ui --locked
   wasm:
     timeout-minutes: 10
@@ -90,4 +95,5 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-keymap-wasm
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo check -p craft-keymap --features ui --locked --target wasm32-unknown-unknown
diff --git a/.github/workflows/media.yml b/.github/workflows/media.yml
index 804034ad..6cb6f0b0 100644
--- a/.github/workflows/media.yml
+++ b/.github/workflows/media.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-media-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-media-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   lint:
@@ -31,6 +34,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-media-lint
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-media --check
       - run: cargo clippy -p craft-media --all-targets --locked --no-default-features -- -D warnings
       - run: cargo clippy -p craft-media --all-targets --locked --no-default-features --features bitstream -- -D warnings
@@ -53,6 +57,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-media-test
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Build tests while installing ffmpeg
         run: |
           # The man-db index rebuild after dpkg is slow on hosted runners.
diff --git a/.github/workflows/pcraft-format.yml b/.github/workflows/pcraft-format.yml
index e79cebc2..5c69e2dd 100644
--- a/.github/workflows/pcraft-format.yml
+++ b/.github/workflows/pcraft-format.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: pcraft-format-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pcraft-format:
     timeout-minutes: 15
diff --git a/.github/workflows/pdf.yml b/.github/workflows/pdf.yml
index 45ff86c6..9e39611a 100644
--- a/.github/workflows/pdf.yml
+++ b/.github/workflows/pdf.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-pdf-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-pdf-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   native:
@@ -34,6 +37,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
@@ -56,6 +60,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf-backends
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: bash scripts/test-pdf-backends.sh
   wasm:
     name: PDF WASM runtime
@@ -71,6 +76,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf-wasm
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
@@ -98,6 +104,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-plate-test
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
diff --git a/.github/workflows/print.yml b/.github/workflows/print.yml
index 24c372df..4c8fa040 100644
--- a/.github/workflows/print.yml
+++ b/.github/workflows/print.yml
@@ -8,6 +8,11 @@ on:
     paths: ['crates/print/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/print.yml']
 permissions:
   contents: read
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: print-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   print:
     timeout-minutes: 30
diff --git a/.github/workflows/proof.yml b/.github/workflows/proof.yml
index d9bf114c..96b9a109 100644
--- a/.github/workflows/proof.yml
+++ b/.github/workflows/proof.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: craft-proof-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: craft-proof-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   check:
@@ -21,13 +24,13 @@ jobs:
     name: Proofing lint, tests with and without Language data, WASM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # The Language data (craft-i18n `language-data/`), embedded by crates/proof/build.rs.
       # Pinned to storytold/craft-i18n#114's head (#109's SCOWL dictionaries + judgment/judgement,
       # CP2.1); TODO(CP2.1): move to #114's merge commit once it merges.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-i18n
           ref: c239f934ace90b7939afaceb23b472ceeafd6b8a
@@ -40,6 +43,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-proof
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-proof --check
       - name: Without Language data (a fork, docs.rs, offline)
         run: |
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 0086bc24..e498d0b4 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-ui-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-ui-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   native:
@@ -39,6 +42,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-ui
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt --check
       - run: cargo clippy -p craft-ui --all-targets --locked -- -D warnings
       - run: cargo clippy -p craft-ui --all-targets --all-features --locked -- -D warnings
@@ -56,4 +60,5 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-ui-wasm
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo check -p craft-ui --all-features --locked --target wasm32-unknown-unknown
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index c8f3a9ca..02d18f30 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: update-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   update:
     timeout-minutes: 15
@@ -21,7 +27,7 @@ jobs:
         os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The token isn't needed after checkout; cargo runs build scripts and proc macros from
           # dependencies, so don't leave it in .git/config for that third-party code to read.
diff --git a/.github/workflows/vectorcraft-format.yml b/.github/workflows/vectorcraft-format.yml
index 55049d1b..04c90e58 100644
--- a/.github/workflows/vectorcraft-format.yml
+++ b/.github/workflows/vectorcraft-format.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: vectorcraft-format-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   vectorcraft-format:
     timeout-minutes: 15
diff --git a/.github/workflows/web-api.yml b/.github/workflows/web-api.yml
index 4592c071..0ad60ba6 100644
--- a/.github/workflows/web-api.yml
+++ b/.github/workflows/web-api.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: web-api-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   web-api:
     # One OS: the crate is platform-independent JSON handling plus wasm32; no platform code.
diff --git a/.github/workflows/web-host.yml b/.github/workflows/web-host.yml
index f308a1cf..57912e5e 100644
--- a/.github/workflows/web-host.yml
+++ b/.github/workflows/web-host.yml
@@ -12,8 +12,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: shared-web-host-${{ github.ref }}
-  cancel-in-progress: true
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets its own group: it is never cancelled or replaced while queued, so it
+  # always gets to save the cache.
+  group: shared-web-host-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   check:
@@ -33,6 +36,7 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-web-host
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt -p craft-web-host --check
       - run: cargo clippy -p craft-web-host --all-targets --locked -- -D warnings
       - run: cargo clippy -p craft-web-host --all-targets --locked --target wasm32-unknown-unknown -- -D warnings
diff --git a/.github/workflows/window.yml b/.github/workflows/window.yml
index 2d2e420f..ce3d7120 100644
--- a/.github/workflows/window.yml
+++ b/.github/workflows/window.yml
@@ -11,6 +11,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Pull requests share one group per branch, so a newer push cancels the older run. Every other
+  # run (main, manual) gets a group of its own, so it is neither cancelled nor replaced while queued.
+  group: window-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   window:
     timeout-minutes: 15