diff --git a/.gitea/workflows/build-binaries.yml b/.gitea/workflows/build-binaries.yml
index 28c4162..7e4b2a4 100644
--- a/.gitea/workflows/build-binaries.yml
+++ b/.gitea/workflows/build-binaries.yml
@@ -11,6 +11,12 @@ permissions:
   code: read
   releases: write
 
+# The shared runner runs 2 jobs at once now (sow-platform#189); capacity 1 was
+# the implicit mutex. Serialize this workflow explicitly; never cancel mid-run.
+concurrency:
+  group: build-binaries
+  cancel-in-progress: false
+
 jobs:
   build-binaries:
     runs-on: nix-docker
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index cbec1c9..79ee5fa 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -7,6 +7,12 @@ on:
 
 permissions: read-all
 
+# One run per ref: a new push obsoletes the run on the old head, so cancel it
+# and free the runner slot for the run that can still matter.
+concurrency:
+  group: ci-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   ci:
     runs-on: nix-docker
diff --git a/.gitea/workflows/sync-wrappers.yml b/.gitea/workflows/sync-wrappers.yml
index bb63b04..ca1391c 100644
--- a/.gitea/workflows/sync-wrappers.yml
+++ b/.gitea/workflows/sync-wrappers.yml
@@ -16,6 +16,12 @@ on:
 
 permissions: read-all
 
+# The shared runner runs 2 jobs at once now (sow-platform#189); capacity 1 was
+# the implicit mutex. Serialize this workflow explicitly; never cancel mid-run.
+concurrency:
+  group: sync-wrappers
+  cancel-in-progress: false
+
 jobs:
   sync:
     runs-on: nix-docker