diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c804ea3..ec4961e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,9 +6,15 @@ on:
   pull_request:
     branches: [main]
 
+# Keep every non-PR run; only superseded PR validation is cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -21,6 +27,9 @@ jobs:
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
@@ -60,6 +69,7 @@ jobs:
 
   typescript:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -69,6 +79,9 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
+          cache: npm
+          cache-dependency-path: |
+            ts/package-lock.json
           node-version: ${{ matrix.node-version }}
       - run: npm ci
         working-directory: ts
@@ -82,6 +95,12 @@ jobs:
           path: ts/*.tgz
       - uses: actions/setup-python@v5
         with:
+          cache: pip
+          # Parity installs a smaller Python extra than the main test matrix.
+          # Its TypeScript lock keeps those download caches distinct.
+          cache-dependency-path: |
+            pyproject.toml
+            ts/package-lock.json
           python-version: "3.12"
       - run: python -m pip install -e ".[test]"
       - run: python -m pytest tests/test_parity.py tests/test_question_ids.py -q