diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67b3a25f..a707c923 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,8 +60,14 @@ on:
 
 # Cancel any superseded in-flight run for the same ref (e.g. a force-push or a
 # rapid second push to a PR branch) instead of letting both run to completion.
+#
+# The group includes the event, so a release-qualification `workflow_dispatch`
+# run is not cancelled by an ordinary push to the same ref. The release gate
+# requires the latest exact-SHA dispatched run to conclude `success`, and this
+# matrix takes about 50 minutes while merges to `main` land every 30, so a
+# shared group made qualifying `main` a race the release could not win.
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
 # GitHub Actions are pinned to full commit SHAs (not mutable tags) as a
diff --git a/public-artifacts.json b/public-artifacts.json
index e5f7b650..834b8c42 100644
--- a/public-artifacts.json
+++ b/public-artifacts.json
@@ -93,7 +93,7 @@
     },
     {
       "path": ".github/workflows/ci.yml",
-      "sha256": "f48bbee282d3ef293c81af185e2827fcf440ff4719dfc9f91a17d344c49c3108"
+      "sha256": "46976c2a8daa9a936a4db9f64b72719f4618ac3e29ae02d3cc8035dd61c4b356"
     },
     {
       "path": ".github/workflows/citrix-workspace-standin.yml",