diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5c7fc2ce..b206b5cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,8 +1,19 @@
 name: Build Docker Image
 
 on:
+  # Only build/push images on main. Previously this ran on every push to every
+  # branch ("**"), producing a full amd64 + arm64 multi-arch build, push, and
+  # GitHub Release for every feature-branch commit — by far the largest source
+  # of Actions spend in this repo. Feature-branch images are not consumed by any
+  # deploy; use the manual trigger below to build one on demand when needed.
   push:
-    branches: ["**"]
+    branches: [ main ]
+  workflow_dispatch:
+
+# Serialize main builds; a newer main push supersedes an older in-flight build.
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build-amd64:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e4872192..167b5471 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,10 +1,16 @@
 name: Go Tests with Docker Compose
 
 on:
-  push:
-    branches: [ main ]
+  # Tests gate PRs into main. The redundant push:main run (same commits already
+  # tested on the PR) is dropped; keep workflow_dispatch for manual reruns.
   pull_request:
     branches: [ main ]
+  workflow_dispatch:
+
+# Cancel superseded runs when a PR is updated with new commits.
+concurrency:
+  group: test-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test: