diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index da3bed9f..7e0c4b22 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,9 +8,16 @@ on:
   schedule:
     - cron: '0 6 * * 1' # Weekly on Monday at 06:00 UTC
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze
+    # Skip the standing release PR (ci.standingPr.branch), which only bumps versions and changelogs.
+    # The repo check stops a fork from skipping the scan with a branch of the same name.
+    if: ${{ github.head_ref != 'release/next' || github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-latest
     permissions:
       security-events: write
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 77411a6e..0ab9fa33 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -12,6 +12,8 @@ permissions:
 jobs:
   validate:
     name: Validate PR Title
+    # releasekit writes the standing PR's (ci.standingPr.branch) title.
+    if: ${{ github.head_ref != 'release/next' || github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-latest
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
diff --git a/.github/workflows/release-preview.yml b/.github/workflows/release-preview.yml
index 59dba631..af901871 100644
--- a/.github/workflows/release-preview.yml
+++ b/.github/workflows/release-preview.yml
@@ -19,6 +19,8 @@ env:
 jobs:
   preview:
     name: Release Preview
+    # The preview CLI skips the standing PR (ci.standingPr.branch) itself, but only after a full checkout and build.
+    if: ${{ github.head_ref != 'release/next' || github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout