diff --git a/.github/workflows/build-push-test.yml b/.github/workflows/build-push-test.yml
index 6d9e39f1..9bbb314d 100644
--- a/.github/workflows/build-push-test.yml
+++ b/.github/workflows/build-push-test.yml
@@ -18,7 +18,7 @@ permissions: {}
 jobs:
   build-push-test-base:
     name: 🍨 base
-    uses: ./.github/workflows/wc-build-push-test.yml
+    uses: $/.github/workflows/wc-build-push-test.yml
     permissions: &build-push-test-permissions
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -54,7 +54,7 @@ jobs:
           - flavor: embedded-rust
             dockerfile: .devcontainer/rust/Dockerfile
             build-embedded-flavor: true
-    uses: ./.github/workflows/wc-build-push-test.yml
+    uses: $/.github/workflows/wc-build-push-test.yml
     secrets:
       TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
       TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 9a9eac41..abee08e0 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -15,7 +15,7 @@ permissions: {}
 jobs:
   build-push-test:
     name: Build → Push → Test
-    uses: ./.github/workflows/build-push-test.yml
+    uses: $/.github/workflows/build-push-test.yml
     permissions:
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -33,7 +33,7 @@ jobs:
   dependency-review:
     name: 🔍 Dependency Review
     needs: build-push-test
-    uses: ./.github/workflows/wc-dependency-review.yml
+    uses: $/.github/workflows/wc-dependency-review.yml
     permissions:
       contents: read
       pull-requests: write # is needed by actions/dependency-review-action to write PR summaries
@@ -63,6 +63,6 @@ jobs:
 
   generate-documents:
     name: 📄 Documentation
-    uses: ./.github/workflows/wc-document-generation.yml
+    uses: $/.github/workflows/wc-document-generation.yml
     permissions:
       contents: read
diff --git a/.github/workflows/image-cleanup.yml b/.github/workflows/image-cleanup.yml
index aa6f1f7c..86560a87 100644
--- a/.github/workflows/image-cleanup.yml
+++ b/.github/workflows/image-cleanup.yml
@@ -6,6 +6,10 @@ on:
     - cron: "0 0 * * 3"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/issue-cleanup.yml b/.github/workflows/issue-cleanup.yml
index 06c43ef3..56b467e3 100644
--- a/.github/workflows/issue-cleanup.yml
+++ b/.github/workflows/issue-cleanup.yml
@@ -5,6 +5,10 @@ on:
   schedule:
     - cron: "30 1 * * *"
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/issue-creation-tool-versions.yml b/.github/workflows/issue-creation-tool-versions.yml
index 1c092c8b..5068ccfb 100644
--- a/.github/workflows/issue-creation-tool-versions.yml
+++ b/.github/workflows/issue-creation-tool-versions.yml
@@ -6,6 +6,10 @@ on:
     - cron: 0 0 1 */3 *
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 1832c164..3bcd2f76 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -9,6 +9,10 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/pr-conventional-title.yml b/.github/workflows/pr-conventional-title.yml
index 4320887e..5c3849b8 100644
--- a/.github/workflows/pr-conventional-title.yml
+++ b/.github/workflows/pr-conventional-title.yml
@@ -8,6 +8,10 @@ on:
       - edited
       - synchronize
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/pr-image-cleanup.yml b/.github/workflows/pr-image-cleanup.yml
index c63b5d89..ebe0d1b3 100644
--- a/.github/workflows/pr-image-cleanup.yml
+++ b/.github/workflows/pr-image-cleanup.yml
@@ -5,6 +5,10 @@ on:
   pull_request:
     types: [closed]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/pr-report.yml b/.github/workflows/pr-report.yml
index f88e8a05..05f6566f 100644
--- a/.github/workflows/pr-report.yml
+++ b/.github/workflows/pr-report.yml
@@ -5,6 +5,10 @@ on:
   pull_request:
     types: [closed]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index e156fab5..215551d6 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -16,7 +16,7 @@ jobs:
   build-push-test:
     name: Build → Push → Test
     if: ${{ !startsWith(github.ref_name, 'actions/') }}
-    uses: ./.github/workflows/build-push-test.yml
+    uses: $/.github/workflows/build-push-test.yml
     permissions:
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -130,14 +130,14 @@ jobs:
   publish-devcontainer-templates:
     name: 📝 Publish templates
     if: ${{ !startsWith(github.ref_name, 'actions/') }}
-    uses: ./.github/workflows/wc-publish-templates.yml
+    uses: $/.github/workflows/wc-publish-templates.yml
     permissions:
       packages: write # is needed by devcontainers/action to write templates as OCI artifacts
 
   generate-documents:
     name: 📄 Documentation
     if: ${{ !startsWith(github.ref_name, 'actions/') }}
-    uses: ./.github/workflows/wc-document-generation.yml
+    uses: $/.github/workflows/wc-document-generation.yml
     with:
       is-release: true
     permissions:
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 92df3d80..8fe0c32e 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -7,6 +7,10 @@ on:
     - cron: "30 2 * * 0"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index 978a8c0f..a5955ad7 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -6,6 +6,10 @@ on:
     - cron: "30 2 * * *"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
diff --git a/.github/workflows/wc-build-push-test.yml b/.github/workflows/wc-build-push-test.yml
index 09baee3e..4438312c 100644
--- a/.github/workflows/wc-build-push-test.yml
+++ b/.github/workflows/wc-build-push-test.yml
@@ -129,7 +129,7 @@ permissions: {}
 jobs:
   build-push:
     name: 🛠️
-    uses: ./.github/workflows/wc-build-push.yml
+    uses: $/.github/workflows/wc-build-push.yml
     permissions:
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -158,7 +158,7 @@ jobs:
     name: 🧪
     if: ${{ inputs.integration-test-file }}
     needs: build-push
-    uses: ./.github/workflows/wc-integration-test-docker.yml
+    uses: $/.github/workflows/wc-integration-test-docker.yml
     permissions:
       contents: read
     secrets: *docker-secrets
@@ -175,7 +175,7 @@ jobs:
     name: 🧪
     if: ${{ inputs.integration-test-file && inputs.integration-test-podman }}
     needs: build-push
-    uses: ./.github/workflows/wc-integration-test-podman.yml
+    uses: $/.github/workflows/wc-integration-test-podman.yml
     permissions:
       contents: read
     secrets: *docker-secrets
@@ -185,7 +185,7 @@ jobs:
     name: 🏗️
     if: ${{ inputs.acceptance-test-devcontainer-file && inputs.acceptance-test-path }}
     needs: build-push
-    uses: ./.github/workflows/wc-acceptance-test.yml
+    uses: $/.github/workflows/wc-acceptance-test.yml
     permissions:
       contents: read
     secrets:
diff --git a/.github/workflows/wc-build-push.yml b/.github/workflows/wc-build-push.yml
index ad4e488a..edbd32e6 100644
--- a/.github/workflows/wc-build-push.yml
+++ b/.github/workflows/wc-build-push.yml
@@ -64,7 +64,7 @@ permissions: {}
 jobs:
   sanitize-image-name:
     name: 🧼
-    uses: ./.github/workflows/wc-sanitize-image-name.yml
+    uses: $/.github/workflows/wc-sanitize-image-name.yml
     with:
       image-name: ${{ inputs.image-name }}
       registry: ${{ inputs.registry }}