diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml
index f89119070d..b31a33fcda 100644
--- a/.github/workflows/strix.yml
+++ b/.github/workflows/strix.yml
@@ -92,6 +92,16 @@ jobs:
 
   strix:
     if: github.event_name != 'pull_request_target' || github.event.action != 'closed'
+    # Org-wide scan serialization: NVIDIA NIM's shared tenant key 429s when
+    # every member repo's PR scans fire in parallel, and the gate correctly
+    # fails closed on provider unavailability -- so unrelated PRs were failing
+    # with zero findings purely from org-self-inflicted rate limits. A single
+    # broad group with cancel-in-progress: false QUEUES scans instead of
+    # racing them into the provider. The workflow-level per-PR group above
+    # still cancels superseded runs of the same PR.
+    concurrency:
+      group: strix-org-wide-nim-scan
+      cancel-in-progress: false
     # Large repositories can require a legitimate full-hour review. The scanner
     # gets a 90-minute process budget and a 95-minute total retry budget; the
     # 100-minute step and 120-minute job leave deterministic time to preserve