diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af4c9cca..b8600f19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,11 +3,17 @@ name: CI
 # Event-driven (no cron). Replaces the old NewBuild.yml + Tests.yml.
 # release.yml and nightly.yml reuse this via `workflow_call` / `workflow_run`.
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
   workflow_call: {}
+  workflow_dispatch: {}
+
+# Pushing three times to a branch used to queue three full matrices and run all of them. A newer
+# pull-request run supersedes the older one; a push to main is not cancelled, because main wants a
+# recorded result for every commit rather than only for the newest.
+concurrency:
+  group: ci-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # Force JavaScript-based actions to run on Node 24 instead of the deprecated Node 20 ahead of
 # the 2026-06-16 hard cutover, until we bump each action to a Node-24-native major version.
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 1f2f3df1..af81cc24 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -3,10 +3,8 @@ name: Nightly
 # After CI succeeds on main, publish a dated prerelease with the packed
 # packages, then prune old nightlies on a GFS schedule. Does NOT push to NuGet.
 on:
-  workflow_run:
-    workflows: [CI]
+  push:
     branches: [main]
-    types: [completed]
   workflow_dispatch: {}
 
 # Force JavaScript-based actions to run on Node 24 instead of the deprecated Node 20 ahead of
@@ -16,7 +14,6 @@ env:
 
 jobs:
   nightly:
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -63,7 +60,7 @@ jobs:
         with:
           tag_name: ${{ env.NIGHTLY_TAG }}
           name: ${{ env.NIGHTLY_TAG }}
-          target_commitish: ${{ github.event.workflow_run.head_sha || github.sha }}
+          target_commitish: ${{ github.sha }}
           prerelease: true
           files: artifacts/*.nupkg
           body_path: RELEASE_NOTES.md           # commit-message changelog, not GitHub's PR notes