diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 31733ff..6a4e640 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,12 @@ on:
       - master
   pull_request:
 
+# Cancel a superseded PR build when new commits are pushed to the same PR.
+# Never cancel a master build, so a release build is not dropped by a later merge.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     runs-on: windows-latest
@@ -27,6 +33,7 @@ jobs:
         dotnet-version: '10.x'
 
     - name: Install AzureSignTool
+      if: github.event_name == 'push'
       run: dotnet tool install --global AzureSignTool
 
     - name: Restore NuGet packages
@@ -66,6 +73,7 @@ jobs:
           /p:PublishReadyToRun=true
 
     - name: Sign executables
+      if: github.event_name == 'push'
       env:
         AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
         AZURE_APPLICATION_ID: ${{ secrets.AZURE_APPLICATION_ID }}
@@ -134,6 +142,7 @@ jobs:
       shell: pwsh
 
     - name: Sign MSI
+      if: github.event_name == 'push'
       env:
         AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
         AZURE_APPLICATION_ID: ${{ secrets.AZURE_APPLICATION_ID }}
@@ -159,6 +168,7 @@ jobs:
         }
 
     - name: Upload MSI artifact
+      if: github.event_name == 'push'
       uses: actions/upload-artifact@v4
       with:
         name: MSI