diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 655ff06..963d058 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,8 +8,8 @@ on:
 # Cancel superseded evidence for the same pull request or branch. This keeps the
 # runner queue bounded during review-fix loops while preserving the newest head.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # Least-privilege default token (OSSF Scorecard: Token-Permissions).
 permissions:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 9b3b713..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: CodeQL
-
-on:
-  push:
-    branches: [main]
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-  pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-
-# Code scanning evidence is head-specific; cancel scans made obsolete by a
-# newer commit on the same pull request or branch.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  analyze:
-    name: CodeQL (python)
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-        with:
-          languages: python
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
diff --git a/services/account_unification/tests/test_workflow_concurrency_contract.py b/services/account_unification/tests/test_workflow_concurrency_contract.py
new file mode 100644
index 0000000..eafc6ca
--- /dev/null
+++ b/services/account_unification/tests/test_workflow_concurrency_contract.py
@@ -0,0 +1,22 @@
+"""Queue-bounding contracts for repository-owned GitHub Actions workflows."""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[3]
+WORKFLOWS = ROOT / ".github" / "workflows"
+
+
+def test_ci_cancels_only_superseded_heads_from_the_same_pull_request() -> None:
+    workflow = (WORKFLOWS / "ci.yml").read_text(encoding="utf-8")
+
+    assert (
+        "group: ${{ github.workflow }}-${{ github.repository }}-"
+        "${{ github.event_name == 'pull_request' && "
+        "github.event.pull_request.number || github.run_id }}"
+    ) in workflow
+    assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in workflow
+
+
+def test_central_codeql_is_not_duplicated_locally() -> None:
+    assert not (WORKFLOWS / "codeql.yml").exists()