diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95e2508..5b70ec9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,12 @@ on:
 permissions:
   contents: read
 
+# PR runs are keyed by PR number (repo-assigned, so a fork branch named "main"
+# cannot collide with and cancel trusted runs on this repo's main). Push and
+# workflow_dispatch runs share a group per ref_name so a dispatched run is
+# cancelled when a push supersedes it, and vice versa.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
   cancel-in-progress: true
 
 jobs: