diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 595a6c1..61b409b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -7,89 +7,82 @@ on:
     branches: [main]
   workflow_dispatch: {}
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   test:
-
     runs-on: ${{ matrix.os }}
 
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-latest, ubuntu-latest]
         python-version: ["3.12", "3.13", "3.14"]
         backend: [numpy, numba, jax, torch]
+        include:
+          # Coverage leg: full suite, all backends, one Python/OS. Folded in
+          # from the former standalone `coverage:` job (spec A8).
+          - os: ubuntu-latest
+            python-version: "3.13"
+            backend: all
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v2
+        uses: astral-sh/setup-uv@v6
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
-        with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install the project
         run: |
-          if [ "${{ matrix.backend }}" = "numpy" ]; then
+          if [ "${{ matrix.backend }}" = "all" ]; then
+            uv sync --all-extras --dev
+          elif [ "${{ matrix.backend }}" = "numpy" ]; then
             uv sync
           else
             uv sync --extra ${{ matrix.backend }}
           fi
 
       - name: Run tests
-        run: uv run pytest tests/ --backend ${{matrix.backend }}
-
-  coverage:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v2
-        with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-
-      - name: Install the project
-        run: uv sync --all-extras --dev
+        if: matrix.backend != 'all'
+        run: uv run pytest tests/ --backend ${{ matrix.backend }}
 
       - name: Run tests with coverage
+        if: matrix.backend == 'all'
         run: |
           uv run pytest --cov=scoringrules tests/
           uv run coverage xml
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v4
+        if: matrix.backend == 'all'
+        uses: codecov/codecov-action@v5
         with:
-          file: ./coverage.xml
+          files: ./coverage.xml
           flags: unittests
-          env_vars: OS,PYTHON
           name: codecov-umbrella
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}
 
-
   lint:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.13"
 
       - name: Run pre-commit hooks
         run: uvx pre-commit run --all-files