diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31cfe28..7118f74 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,10 +5,24 @@ on:
     branches: [main]
   pull_request:
 
+concurrency:
+  # A new push to the same PR or branch supersedes the run in flight. Without
+  # this every push queued a *fresh* full set of jobs alongside the old ones,
+  # so a branch pushed five times held five complete matrices at once — on
+  # paid Blacksmith runners, and with nothing reclaiming the superseded work.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     name: fmt + clippy + test (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    # Capped because the GitHub default is **six hours** per job, and this
+    # workflow is reachable from a fork pull request. Measured over the last
+    # six runs the slowest job here is 2m07s, so 20 minutes is roughly 9x
+    # headroom while removing the runaway: a stuck or hostile job now costs
+    # 20 minutes of a paid runner rather than a working day of one.
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix: