diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 95f51e8..aa326fa 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,10 +1,22 @@
 name: tests
 
+# A branch is tested through its pull request, which runs on the merge
+# commit GitHub prepares. Running on every push as well tested each commit
+# twice. Pushes to master are still tested, and any other branch can be run
+# by hand (Actions tab, "Run workflow").
 on:
   push:
-    branches: ["**"]   # every branch; a version tag runs these tests through release.yml instead
+    branches: [master]   # a version tag runs these tests through release.yml instead
   pull_request:
-  workflow_call:       # release.yml runs the whole workflow before it publishes
+  workflow_dispatch:
+  workflow_call:         # release.yml runs the whole workflow before it publishes
+
+# One run per pull request at a time: a new push to a pull request cancels
+# the run of the commit it replaces. Runs on master are never cancelled,
+# so every merged commit keeps its result.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # The jobs only read the repository
 permissions: