diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fc89d9a..c15bd8f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,5 +7,8 @@ updates:
     groups:
       actions:
         patterns: ["*"]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
     cooldown:
       default-days: 7
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8c987f..5317c99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- `templates/dependabot.yml`: security updates come as one grouped PR per ecosystem (`applies-to: security-updates`) instead of one PR per package. The version-update groups never applied to them.
+- Caller templates: a new push to a pull request cancels that pull request's previous Status checks run (workflow-level `concurrency`). Push, schedule and merge-queue runs are never cancelled.
 - Templates: no `codeql` job. Public repositories in the organization get CodeQL through default setup, which rejects results from `codeql.yml`.
 
 ## v1.1.3
diff --git a/templates/dependabot.yml b/templates/dependabot.yml
index 38cc29e..430e6bc 100644
--- a/templates/dependabot.yml
+++ b/templates/dependabot.yml
@@ -1,7 +1,8 @@
 # Copy to .github/dependabot.yml in every repository and delete the
-# ecosystems you don't use. Updates are grouped (one PR per ecosystem) and
-# wait 7 days after a release (cooldown) so compromised releases are usually
-# yanked before they reach us. Security updates are not delayed.
+# ecosystems you don't use. Updates are grouped (one PR per ecosystem, plus
+# one for its security updates) and wait 7 days after a release (cooldown)
+# so compromised releases are usually yanked before they reach us. Security
+# updates are not delayed.
 version: 2
 updates:
   - package-ecosystem: github-actions # also bumps the shared workflows
@@ -9,6 +10,7 @@ updates:
     schedule: { interval: weekly, day: monday }
     groups:
       actions: { patterns: ["*"] }
+      actions-security: { applies-to: security-updates, patterns: ["*"] }
     cooldown: { default-days: 7 }
 
   - package-ecosystem: docker # bumps tag AND @sha256 digest of FROM lines
@@ -23,6 +25,7 @@ updates:
     schedule: { interval: weekly, day: monday }
     groups:
       go: { patterns: ["*"], update-types: [minor, patch] }
+      go-security: { applies-to: security-updates, patterns: ["*"] }
     cooldown: { default-days: 7 }
 
   - package-ecosystem: npm
@@ -31,6 +34,7 @@ updates:
     groups:
       npm-production: { dependency-type: production, update-types: [minor, patch] }
       npm-development: { dependency-type: development, update-types: [minor, patch] }
+      npm-security: { applies-to: security-updates, patterns: ["*"] }
     cooldown: { default-days: 7 }
 
   - package-ecosystem: terraform
diff --git a/templates/workflows/status-checks-go.yml b/templates/workflows/status-checks-go.yml
index 458f5b6..4c32abb 100644
--- a/templates/workflows/status-checks-go.yml
+++ b/templates/workflows/status-checks-go.yml
@@ -12,6 +12,12 @@ on:
 
 permissions: {}
 
+# A new push to a PR cancels the PR's previous run. Other events get a
+# group of their own (run_id), so they never wait for or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   go:
     uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@v1
diff --git a/templates/workflows/status-checks-node.yml b/templates/workflows/status-checks-node.yml
index 5b209b3..bc021dd 100644
--- a/templates/workflows/status-checks-node.yml
+++ b/templates/workflows/status-checks-node.yml
@@ -12,6 +12,12 @@ on:
 
 permissions: {}
 
+# A new push to a PR cancels the PR's previous run. Other events get a
+# group of their own (run_id), so they never wait for or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   node:
     uses: privacybydesign/github-workflows/.github/workflows/node-checks.yml@v1
diff --git a/templates/workflows/terraform.yml b/templates/workflows/terraform.yml
index e4b1b79..cdf0591 100644
--- a/templates/workflows/terraform.yml
+++ b/templates/workflows/terraform.yml
@@ -13,6 +13,12 @@ on:
 
 permissions: {}
 
+# A new push to a PR cancels the PR's previous run. Other events get a
+# group of their own (run_id), so they never wait for or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   terraform:
     strategy: