diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f741a7d..e79a1be 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -65,6 +65,7 @@ updates:
     # enough that a 7-day window broke most runs. 1 day still enforces the
     # 24-hour publish delay the house standard asks for.
     cooldown:
+      # jactionlint ignore=dependabot-cooldown
       default-days: 1
     commit-message:
       prefix: "chore(deps)"
diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml
index cf9a50e..a753ec7 100644
--- a/.github/jactionlint.yaml
+++ b/.github/jactionlint.yaml
@@ -1,2 +1,2 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/jdx/jactionlint/main/schema/jactionlint-config.json
-profile: correctness
+profile: default
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7cfc544..7097d40 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -8,10 +8,15 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint:
     name: lint
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -44,6 +49,7 @@ jobs:
   pytest:
     name: pytest (py${{ matrix.python-version }})
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     strategy:
       fail-fast: false
       matrix:
@@ -64,6 +70,7 @@ jobs:
   bootstrap:
     name: bootstrap
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -101,6 +108,7 @@ jobs:
   test:
     name: test
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     needs: [lint, pytest, bootstrap]
     if: always()
     steps:
@@ -121,6 +129,7 @@ jobs:
     name: commitlint
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -139,6 +148,7 @@ jobs:
   zizmor:
     name: zizmor
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 5a8277d..e247e5b 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -22,6 +22,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-26.04
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: docs/site
@@ -57,6 +58,7 @@ jobs:
     # trigger above decorative -- it would build and then skip the deploy.
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     permissions:
       pages: write
       id-token: write
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1f07563..45edee5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -22,6 +22,7 @@ permissions: {}
 jobs:
   release-please:
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     if: github.repository_owner == 'yo61'
     permissions:
       contents: read
@@ -53,6 +54,7 @@ jobs:
   sync-lockfile:
     needs: release-please
     runs-on: ubuntu-26.04
+    timeout-minutes: 5
     permissions: {}
     steps:
       - id: create_token
@@ -263,6 +265,7 @@ jobs:
       needs.release-please.outputs.release_created == 'true'
       && vars.PYPI_PUBLISH != 'false'
     runs-on: ubuntu-26.04
+    timeout-minutes: 10
     environment:
       name: pypi
       url: https://pypi.org/p/python-template