diff --git a/.github/workflows/angular.yml b/.github/workflows/angular.yml
index cd48c0448a..841a0d944d 100644
--- a/.github/workflows/angular.yml
+++ b/.github/workflows/angular.yml
@@ -15,6 +15,11 @@ on:
       - synchronize
       - reopened
       - ready_for_review
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 86df2d8748..e2033cf1c3 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -21,6 +21,9 @@ on:
       - '.github/workflows/build-and-test.yml'
 
   pull_request:
+    branches:
+      - dev
+      - 'rel-*'
     paths:
       - 'framework/**/*.cs'
       - 'framework/**/*.cshtml'
@@ -42,8 +45,14 @@ on:
       - synchronize
       - reopened
       - ready_for_review
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   build-test:
@@ -51,14 +60,18 @@ jobs:
     timeout-minutes: 50
     if: ${{ !github.event.pull_request.draft }}
     steps:
-    - uses: jlumbroso/free-disk-space@main
-    - uses: PSModule/install-powershell@v1
-      with:
-        Version: latest
-    - uses: actions/checkout@v2
-    - uses: actions/setup-dotnet@master
+    - uses: jlumbroso/free-disk-space@v1.3.1
+    - uses: actions/checkout@v4
+    - uses: actions/setup-dotnet@v4
       with:
         dotnet-version: 10.0.x
+    - name: Cache NuGet packages
+      uses: actions/cache@v4
+      with:
+        path: ~/.nuget/packages
+        key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', 'Directory.Packages.props') }}
+        restore-keys: |
+          ${{ runner.os }}-nuget-
     - name: Build All
       run: ./build-all.ps1
       working-directory: ./build
@@ -70,4 +83,8 @@ jobs:
       shell: pwsh
 
     - name: Codecov
-      uses: codecov/codecov-action@v2
+      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+      uses: codecov/codecov-action@v5
+      with:
+        use_oidc: true
+        fail_ci_if_error: true
diff --git a/.github/workflows/cancel-workflow.yml b/.github/workflows/cancel-workflow.yml
index 039943ad66..4d868f6b85 100644
--- a/.github/workflows/cancel-workflow.yml
+++ b/.github/workflows/cancel-workflow.yml
@@ -1,17 +1,21 @@
+# This workflow is intentionally disabled.
+# The workflows that previously depended on this file now handle cancellation
+# natively via per-workflow `concurrency` blocks.
+# The styfle/cancel-workflow-action has been archived upstream and is no longer maintained.
+#
+# To re-enable manual cancellation, change `on: workflow_dispatch` back to `on: [push]`
+# and restore the styfle step, but the native `concurrency` approach is preferred.
 name: cancel-workflow
-on: [push]
+on:
+  workflow_dispatch:
 permissions:
   contents: read
 
 jobs:
   cancel:
-    permissions:
-      actions: write  # for styfle/cancel-workflow-action to cancel/stop running workflows
-    name: 'Cancel Previous Runs'
+    name: 'Disabled - See file header comment'
     runs-on: ubuntu-latest
-    timeout-minutes: 3
+    timeout-minutes: 1
     steps:
-      - uses: styfle/cancel-workflow-action@0.6.0
-        with:
-          workflow_id: 10629,1299107,2792859,8268314
-          access_token: ${{ github.token }}
+      - name: No-op
+        run: echo "Cancellation is handled via concurrency groups in each workflow."
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d1f6c0c503..16e0443f08 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -29,6 +29,10 @@ on:
       - reopened
       - ready_for_review
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/image-compression.yml b/.github/workflows/image-compression.yml
index 9eef6db59b..ed4111cdd3 100644
--- a/.github/workflows/image-compression.yml
+++ b/.github/workflows/image-compression.yml
@@ -12,6 +12,11 @@ on:
       - synchronize
       - reopened
       - ready_for_review
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     if: github.event.pull_request.head.repo.full_name == github.repository && !github.event.pull_request.draft
@@ -23,5 +28,3 @@ jobs:
 
       - name: Compress Images
         uses: calibreapp/image-actions@main
-        with:
-          githubToken: ${{ secrets.GITHUB_TOKEN }}