diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 098b3a6..f5d3e01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 env:
@@ -125,7 +125,7 @@ jobs:
         with:
           dotnet-version: 8.0.x
       - name: Restore portable runtime
-        run: dotnet restore GameAgentRuntime.sln
+        run: dotnet restore GameAgentRuntime.sln --locked-mode
       - name: Build portable runtime
         run: >-
           dotnet build GameAgentRuntime.sln -c Release
diff --git a/.github/workflows/trusted-source-privacy.yml b/.github/workflows/trusted-source-privacy.yml
index 72842fd..8501fef 100644
--- a/.github/workflows/trusted-source-privacy.yml
+++ b/.github/workflows/trusted-source-privacy.yml
@@ -11,6 +11,8 @@ concurrency:
   group: trusted-release-gate-${{ github.event.workflow_run.id }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   DOTNET_CLI_TELEMETRY_OPTOUT: "1"
   DOTNET_NOLOGO: "1"
@@ -218,7 +220,7 @@ jobs:
         with:
           dotnet-version: 8.0.x
       - name: Restore portable runtime
-        run: dotnet restore GameAgentRuntime.sln
+        run: dotnet restore GameAgentRuntime.sln --locked-mode
       - name: Build portable runtime
         run: >-
           dotnet build GameAgentRuntime.sln -c Release
diff --git a/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs b/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs
index 939bf66..8026fbf 100644
--- a/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs
+++ b/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs
@@ -6410,12 +6410,17 @@ public async Task DurationDeadlineIgnoresThrowingCancellationCallbacks()
                 maxProviderAttempts: 2,
                 delay);
             var run = Run(clock.UtcNow);
-            run.Budget.MaxDurationMs = 500;
+            run.Budget.MaxDurationMs = 2_000;
 
-            var outcome = await runtime.RunAsync(
+            var running = runtime.RunAsync(
                     new DurableRunRequest { Run = run }, cancellationToken: TestContext.Current.CancellationToken)
-                .AsTask()
-                .WaitAsync(TimeSpan.FromSeconds(3), cancellationToken: TestContext.Current.CancellationToken);
+                .AsTask();
+            await delay.Started.Task.WaitAsync(
+                TestWaitTimeout,
+                cancellationToken: TestContext.Current.CancellationToken);
+            var outcome = await running.WaitAsync(
+                TimeSpan.FromSeconds(10),
+                cancellationToken: TestContext.Current.CancellationToken);
 
             Assert.Equal(RunStates.BudgetExhausted, outcome.Run.State);
             Assert.Equal("max_duration", outcome.Run.TerminalReason);
@@ -6937,6 +6942,9 @@ public async Task DetachedPreparationDoesNotStarveGlobalProviderAdmission()
 
             second.Release();
             await second.Settled.WaitAsync(TestWaitTimeout, cancellationToken: TestContext.Current.CancellationToken);
+            Assert.True(
+                await WaitUntilAsync(
+                    () => runtime.DetachedProviderCleanupCount == 1));
             var next = runtime.RunAsync(
                     new DurableRunRequest { Run = Run(clock.UtcNow) }, cancellationToken: TestContext.Current.CancellationToken)
                 .AsTask();