diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4b963e015..09f03e0e0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,6 +19,16 @@ on:
   schedule:
     - cron: "42 6 * * 0"
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -28,6 +38,7 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: 45
     permissions:
       # required for all workflows
       security-events: write
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index f458572eb..7de102c2d 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -8,10 +8,21 @@ on:
 permissions:
   contents: read
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   check-claude-md-symlink:
     name: CLAUDE.md symlink guard
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
 
@@ -42,6 +53,7 @@ jobs:
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4
 
@@ -103,6 +115,7 @@ jobs:
 
   format-typescript:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: crates/trusted-server-js/lib
@@ -134,6 +147,7 @@ jobs:
 
   format-docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: docs
@@ -175,6 +189,7 @@ jobs:
   docs-proposal-scripts:
     name: docs-proposal scripts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 157a3582d..2346f5a52 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -10,6 +10,16 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 env:
   ORIGIN_PORT: 8888
   ARTIFACTS_DIR: /tmp/integration-test-artifacts
diff --git a/.github/workflows/pbs-example.yml b/.github/workflows/pbs-example.yml
index dced0c7b6..2c1fb0730 100644
--- a/.github/workflows/pbs-example.yml
+++ b/.github/workflows/pbs-example.yml
@@ -17,6 +17,16 @@ on:
 permissions:
   contents: read
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   local-checks:
     name: PBS Terraform and Compose checks
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b27173dd6..0514afee2 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,6 +8,16 @@ on:
     branches: [main]
   pull_request:
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   test-rust:
     name: cargo test
@@ -68,6 +78,7 @@ jobs:
   test-axum:
     name: cargo test (axum native)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 
@@ -116,6 +127,7 @@ jobs:
   test-cloudflare:
     name: cargo check (cloudflare native + wasm32-unknown-unknown)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
@@ -137,6 +149,7 @@ jobs:
   test-spin:
     name: cargo check/build/test (spin native + wasm32-wasip1)
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -170,6 +183,7 @@ jobs:
   test-parity:
     name: cargo test (cross-adapter parity)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
@@ -195,6 +209,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
 
@@ -259,6 +274,7 @@ jobs:
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: crates/trusted-server-js/lib