diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6b26d19..25bbcfa 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,11 +1,16 @@
 ---
 name: Lint
 
+# PR-only: branch protection makes the merge commit identical to the
+# last PR head, so re-running on push to main is duplicate work. See
+# DevSecNinja/.github docs/workflow-trigger-conventions.md.
 on:
   pull_request:
-  push:
-    branches:
-      - main
+  workflow_dispatch: # checkov:skip=CKV_GHA_7: Validation workflow only -- no artifacts produced.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read