diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 3a1a7e8..44ea14a 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -3,9 +3,22 @@ name: Build Debian Packages
 on:
   push:
     branches: [ main ]
+  pull_request:
+    branches: [ main ]
+    paths:
+      - '.github/workflows/build-deb.yml'
+      - 'debian/**'
+      - 'docker/**'
+      - 'Dockerfile.linux'
   workflow_dispatch:
   workflow_call:
 
+# A new push to a pull request cancels the previous run. Other events get their own
+# group so they are never cancelled or replaced.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -143,7 +156,8 @@ jobs:
               bash -euxc "./docker/build.sh"
 
       - name: Save ccache
-        if: ${{ !cancelled() }}
+        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        if: ${{ !cancelled() && github.event_name != 'pull_request' }}
         uses: actions/cache/save@v4
         with:
           path: .ccache
diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index ea803ab..d7db10b 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -3,9 +3,19 @@ name: Build MacOS
 on:
   push:
     branches: [ main ]
+  pull_request:
+    branches: [ main ]
+    paths:
+      - '.github/workflows/build-macos.yml'
   workflow_dispatch:
   workflow_call:
 
+# A new push to a pull request cancels the previous run. Other events get their own
+# group so they are never cancelled or replaced.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -84,7 +94,8 @@ jobs:
       run: ccache --show-stats
 
     - name: Save ccache
-      if: ${{ !cancelled() }}
+      # Pull requests only read the cache, pushes to main and manual runs populate it.
+      if: ${{ !cancelled() && github.event_name != 'pull_request' }}
       uses: actions/cache/save@v4
       with:
         path: .ccache
diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 2321ca8..979baf7 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -3,9 +3,19 @@ name: Build Windows Package
 on:
   push:
     branches: [ main ]
+  pull_request:
+    branches: [ main ]
+    paths:
+      - '.github/workflows/build-windows.yml'
   workflow_dispatch:
   workflow_call:
 
+# A new push to a pull request cancels the previous run. Other events get their own
+# group so they are never cancelled or replaced.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -184,7 +194,8 @@ jobs:
         run: ccache --show-stats
 
       - name: Save ccache
-        if: ${{ !cancelled() }}
+        # Pull requests only read the cache, pushes to main and manual runs populate it.
+        if: ${{ !cancelled() && github.event_name != 'pull_request' }}
         uses: actions/cache/save@v4
         with:
           path: .ccache
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index da944bd..90d4260 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,9 +7,27 @@ on:
   pull_request:
     branches:
       - main
+    # Only on pull requests: the release needs a successful run for every commit on main.
+    # If Tests ever becomes a required check, a skipped run stays Pending and blocks the merge.
+    paths-ignore:
+      - 'README.md'
+      - 'LICENSE'
+      - '.gitignore'
+      - 'donate.png'
+      - 'docs/**'
+      # other workflows, not run by this one (build-*.yml have their own pull_request trigger)
+      - '.github/workflows/build-*.yml'
+      - '.github/workflows/codacy.yml'
+      - '.github/workflows/release.yml'
 
   workflow_dispatch:
 
+# A new push to a pull request cancels the previous run. Runs that are not
+# from a pull request get their own group so they are never cancelled or replaced.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -17,6 +35,7 @@ jobs:
   linux:
     runs-on: ubuntu-24.04
     name: linux (pytest)
+    timeout-minutes: 120
     env:
       CCACHE_DIR: ${{ github.workspace }}/.ccache
       CCACHE_MAXSIZE: 500M