diff --git a/.github/workflows/preview-deploy.yml b/.github/workflows/preview-deploy.yml
index 255bb2e..9161745 100644
--- a/.github/workflows/preview-deploy.yml
+++ b/.github/workflows/preview-deploy.yml
@@ -26,7 +26,7 @@ jobs:
 
       - name: Deploy to Vercel preview
         id: vercel
-        uses: amondnet/vercel-action@v25
+        uses: amondnet/vercel-action@16e87c0a08142b0d0d33b76aeaf20823c381b9b9 # v25
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 273417c..1e0924a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,9 @@ permissions:
 jobs:
   release:
     name: release
+    concurrency:
+      group: release-${{ github.ref }}
+      cancel-in-progress: false # Queue semantic-release to prevent duplicate git tags/releases
     runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event.workflow_run.conclusion == 'success'
diff --git a/.github/workflows/rollback-drill.yml b/.github/workflows/rollback-drill.yml
index faafc9d..6ff10f5 100644
--- a/.github/workflows/rollback-drill.yml
+++ b/.github/workflows/rollback-drill.yml
@@ -15,6 +15,10 @@ permissions:
 jobs:
   rollback-drill:
     runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}
+      cancel-in-progress: false # Concurrent runs could submit conflicting rollback transactions against the same testnet contract state
+    timeout-minutes: 15
     environment: testnet
 
     steps: