diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b0df0f4..94058c0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,6 +27,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
index 5b07707..b10ae87 100644
--- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml
+++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
@@ -61,6 +61,7 @@ jobs:
 
   provenance:
     needs: [build]
+    timeout-minutes: 10
     permissions:
       actions: read   # To read the workflow path.
       id-token: write # To sign the provenance.
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 028da8e..f674c15 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -6,6 +6,14 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read