diff --git a/.github/workflows/eh-transport.yml b/.github/workflows/eh-transport.yml
index 4a33949b48..ad8d9f0087 100644
--- a/.github/workflows/eh-transport.yml
+++ b/.github/workflows/eh-transport.yml
@@ -32,9 +32,13 @@ on:
     branches: [main]
 
 concurrency:
-  group: eh-transport-${{ github.ref }}
-  # Cancel superseded PR runs, never main runs — a busy merge day would
-  # otherwise starve the gate to zero executions.
+  group: eh-transport-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  # One group per main COMMIT, cancelling PR runs only. `cancel-in-progress:
+  # false` alone does not protect a `main` run: GitHub allows at most one
+  # PENDING run per group and cancels the previously pending one when a new run
+  # enters, regardless of that setting. That is #7205 — measured here as EIGHT
+  # consecutive `main` runs cancelled, zero executions. Keying push runs on the
+  # SHA gives every merged commit a group of its own.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
diff --git a/.github/workflows/llvm-inprocess.yml b/.github/workflows/llvm-inprocess.yml
index 078d9736aa..2c572a7459 100644
--- a/.github/workflows/llvm-inprocess.yml
+++ b/.github/workflows/llvm-inprocess.yml
@@ -20,9 +20,13 @@ on:
     branches: [main]
 
 concurrency:
-  group: llvm-inprocess-${{ github.ref }}
-  # Gate-trap 3: cancel superseded PR runs, but NEVER cancel main runs — a
-  # busy merge day would otherwise starve the gate to zero executions.
+  group: llvm-inprocess-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  # One group per main COMMIT, cancelling PR runs only. `cancel-in-progress:
+  # false` alone does not protect a `main` run: GitHub allows at most one
+  # PENDING run per group and cancels the previously pending one when a new run
+  # enters, regardless of that setting. That is #7205 — measured here as EIGHT
+  # consecutive `main` runs cancelled, zero executions. Keying push runs on the
+  # SHA gives every merged commit a group of its own.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index ee746829e6..6a0a72ed1b 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -12,8 +12,17 @@ permissions:
   contents: read
 
 concurrency:
-  group: security-audit-${{ github.ref }}
-  cancel-in-progress: true
+  # One group per main COMMIT, cancelling PR runs only. Two separate problems
+  # were live here, and this is a REQUIRED status check: it had NINE cancelled
+  # `main` runs and zero executions.
+  #
+  # `cancel-in-progress: true` cancels main runs outright, and even `false`
+  # would not have been enough — GitHub allows at most one PENDING run per
+  # group and cancels the previously pending one when a new run enters,
+  # regardless of that setting (#7205). Keying push runs on the SHA gives every
+  # merged commit a group of its own.
+  group: security-audit-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   security-audit: