diff --git a/.github/workflows/navigator_check.yml b/.github/workflows/navigator_check.yml
index 384dea3..8ec2ba8 100644
--- a/.github/workflows/navigator_check.yml
+++ b/.github/workflows/navigator_check.yml
@@ -5,8 +5,18 @@ name: Navigator Check
 # PyAutoHands/autohands; this repo only declares which generator project to run.
 # See PyAutoLabs/PyAutoHands/.github/workflows/navigator_check.yml.
 
-on: [push, pull_request]
+# One run per commit: PR events carry the CI; pushes only build main
+# (Heart's ws_ci gate reads main-HEAD conclusions). Superseded runs are
+# cancelled on PR refs only — a cancelled main run would read as red CI
+# (cancelled is in Heart's FAILURE_CONCLUSIONS).
+on:
+  push:
+    branches: [main]
+  pull_request:
 
+concurrency:
+  group: navigator_check-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 permissions:
   contents: read
 
diff --git a/.github/workflows/smoke_tests.yml b/.github/workflows/smoke_tests.yml
index 2eb2a1e..6271df6 100644
--- a/.github/workflows/smoke_tests.yml
+++ b/.github/workflows/smoke_tests.yml
@@ -5,8 +5,18 @@ name: Smoke Tests
 # workspace declares its dependency chain and owns its install epilogue
 # (.github/scripts/smoke_install.sh) and runner (.github/scripts/run_smoke.py).
 
-on: [push, pull_request]
+# One run per commit: PR events carry the CI; pushes only build main
+# (Heart's ws_ci gate reads main-HEAD conclusions). Superseded runs are
+# cancelled on PR refs only — a cancelled main run would read as red CI
+# (cancelled is in Heart's FAILURE_CONCLUSIONS).
+on:
+  push:
+    branches: [main]
+  pull_request:
 
+concurrency:
+  group: smoke_tests-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 jobs:
   smoke:
     uses: PyAutoLabs/PyAutoHeart/.github/workflows/smoke-tests.yml@main
diff --git a/.github/workflows/tutorials_complete.yml b/.github/workflows/tutorials_complete.yml
index a3fa780..5347ab7 100644
--- a/.github/workflows/tutorials_complete.yml
+++ b/.github/workflows/tutorials_complete.yml
@@ -6,8 +6,18 @@ name: Tutorials Complete
 # terminal section; the check is pure-stdlib and needs no library install.
 # See scripts/check_tutorials_complete.py.
 
-on: [push, pull_request]
+# One run per commit: PR events carry the CI; pushes only build main
+# (Heart's ws_ci gate reads main-HEAD conclusions). Superseded runs are
+# cancelled on PR refs only — a cancelled main run would read as red CI
+# (cancelled is in Heart's FAILURE_CONCLUSIONS).
+on:
+  push:
+    branches: [main]
+  pull_request:
 
+concurrency:
+  group: tutorials_complete-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 jobs:
   tutorials-complete:
     runs-on: ubuntu-latest