diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 954d5e16..9f7614e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 env:
@@ -90,7 +90,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13", "3.14"]
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.14"]') || fromJSON('["3.11", "3.12", "3.13", "3.14"]') }}
     defaults:
       run:
         working-directory: office
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1d41ef6..b35f7cdf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: release-${{ github.ref_name }}
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref_name }}
   cancel-in-progress: false
 
 env:
@@ -724,4 +724,4 @@ jobs:
           done
 
           echo "::error::Registry publication verification did not converge to the exact artifact digests."
-          exit 1
\ No newline at end of file
+          exit 1
diff --git a/src/workflowExactHead.test.ts b/src/workflowExactHead.test.ts
index d1f05310..828c2828 100644
--- a/src/workflowExactHead.test.ts
+++ b/src/workflowExactHead.test.ts
@@ -68,6 +68,20 @@ const browserJob = workflowJob(workflow, 'browser-release-evidence', 'office');
 const officeJob = workflowJob(workflow, 'office');
 
 describe('exact-head CI workflow contract', () => {
+  it('cancels only superseded runs for the same repository and PR while keeping full main compatibility coverage', () => {
+    expect(workflow).toContain(
+      "group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}",
+    );
+    expect(workflow).toContain('cancel-in-progress: true');
+    expect(officeJob).toContain(
+      "python-version: ${{ github.event_name == 'pull_request' && fromJSON('[\"3.14\"]') || fromJSON('[\"3.11\", \"3.12\", \"3.13\", \"3.14\"]') }}",
+    );
+    expect(releaseWorkflow).toContain(
+      'group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref_name }}',
+    );
+    expect(releaseWorkflow).toContain('cancel-in-progress: false');
+  });
+
   it('uses a fixed runner and checks out the immutable current PR head in every job', () => {
     expect(workflow).not.toContain('ubuntu-latest');
     for (const job of [buildJob, browserJob, officeJob]) {