diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94c57c7e4..71bafacd1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,7 +8,23 @@ on:
     branches: [main]
   pull_request:
 
+# Rapid pushes supersede each other: cancel stale PR runs so only the
+# latest push burns CI minutes. Main pushes and releases never cancel.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
+  # Style-only signal in ~1 minute, no system deps: rustfmt needs
+  # neither the Fedora container nor the GTK stack.
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
   check:
     runs-on: ubuntu-latest
     # ubuntu-latest ships GTK 4.14 / libadwaita 1.4, but the gtk4 (v4_18)
@@ -21,8 +37,7 @@ jobs:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
         with:
-          components: rustfmt, clippy
-      - run: cargo fmt --check
+          components: clippy
       - run: cargo clippy --all-targets -- -D warnings
       # Serial: the suite shares one glib default MainContext across test
       # threads, and glib futures are bound to their spawning thread, so
diff --git a/.github/workflows/flatpak-build.yml b/.github/workflows/flatpak-build.yml
index b5c112a6a..0d4534d53 100644
--- a/.github/workflows/flatpak-build.yml
+++ b/.github/workflows/flatpak-build.yml
@@ -29,6 +29,21 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
 
+      # The GNOME SDK/Platform are immutable per runtime version and
+      # would otherwise re-download (~1 min + GBs) on every pristine
+      # build. Only this layer is cached; the build itself stays
+      # --force-clean. `flatpak install` below stays as-is: on a cache
+      # hit it is a fast no-op (or small delta refresh).
+      - name: Cache GNOME SDK and Platform
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.local/share/flatpak
+            ~/.cache/flatpak
+          key: flatpak-sdk-${{ runner.os }}-${{ hashFiles('build-aux/io.github.houssemko.Grab.json') }}
+          restore-keys: |
+            flatpak-sdk-${{ runner.os }}-
+
       - name: Install Flatpak tooling
         run: |
           sudo apt-get update -qq
diff --git a/.github/workflows/flatpak-test.yml b/.github/workflows/flatpak-test.yml
index 2ef68e4fe..c92d2abd4 100644
--- a/.github/workflows/flatpak-test.yml
+++ b/.github/workflows/flatpak-test.yml
@@ -25,6 +25,12 @@ on:
       - ".github/workflows/flatpak-test.yml"
       - ".github/workflows/flatpak-build.yml"
 
+# Same supersede rule as CI: a new push cancels the stale bundle build.
+# Manual dispatches (exact tags/SHAs) never cancel.
+concurrency:
+  group: flatpak-test-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   bundle:
     uses: ./.github/workflows/flatpak-build.yml
diff --git a/.github/workflows/tarball.yml b/.github/workflows/tarball.yml
index 51ad32133..1027e6805 100644
--- a/.github/workflows/tarball.yml
+++ b/.github/workflows/tarball.yml
@@ -39,6 +39,20 @@ jobs:
           flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
           flatpak install --user -y flathub "org.gnome.Sdk//$RUNTIME" "org.freedesktop.Sdk.Extension.rust-stable//25.08"
 
+      # Same SDK layer cache as the Flatpak builds (immutable per
+      # runtime version), plus the cargo registry: `cargo vendor`
+      # below re-downloads every crate on each pristine run.
+      - name: Cache SDK and cargo registry
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.local/share/flatpak
+            ~/.cache/flatpak
+            .cargo-home/registry
+          key: tarball-deps-${{ runner.os }}-${{ hashFiles('build-aux/io.github.houssemko.Grab.json', 'Cargo.lock') }}
+          restore-keys: |
+            tarball-deps-${{ runner.os }}-
+
       # Same offline-vendor trick as the Flatpak build, done by hand:
       # cargo vendor + a local source replacement, then meson install
       # into a staging dir. Everything runs inside the SDK sandbox.