diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4c64174..22819e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,13 @@ on:
 
   pull_request:
 
+# One live run per PR. A push to a PR branch cancels the run for the commit it just replaced —
+# nobody reads that verdict, and the verify matrix it was still grinding through is ~250 billed
+# minutes. Pushes to main are NEVER cancelled: the run on main is what cuts the prerelease and
+# what chuggie.dev reads its ROM artifacts from, so a superseded one still has to finish.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: write
diff --git a/.github/workflows/screenshot.yml b/.github/workflows/screenshot.yml
index b2eb8d8..4354e3e 100644
--- a/.github/workflows/screenshot.yml
+++ b/.github/workflows/screenshot.yml
@@ -13,6 +13,12 @@ on:
       - "scripts/screenshot.sh"
       - ".github/workflows/screenshot.yml"
 
+# Same rule as ci.yml: a push to the PR cancels the run for the commit it replaced. Written the same
+# way as there (pull_request-only cancel) so the two stay in step if this ever gains a push trigger.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   screenshot:
     runs-on: ubuntu-latest