diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml
index cd69b060d8..9493faf0c6 100644
--- a/.github/workflows/links.yaml
+++ b/.github/workflows/links.yaml
@@ -1,4 +1,5 @@
-# Build the example site and check links with Lychee.
+# Build the example site, check its links with Lychee, and guard the npm-script
+# posture and the committed generated files.
 # cSpell:ignore lycheeverse
 
 name: links
@@ -10,9 +11,15 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+# github.ref: a newer push to main cancels the run in progress too; this
+# workflow only checks, so nothing is lost.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check-links:
+    name: Check links
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e3c7889e5d..c0c692801b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -60,7 +60,7 @@ result. The manifests declare no lifecycle hooks (guarded by
     so its CI still evaluates the allowlist; this repo's `install:safe` has no
     such step.
   - With the key set, a lock-synced hugo-extended bump with no approval would
-    arrive with a green `check-links`.
+    arrive with a green `Check links`.
   - The Netlify build is script-free (`install:safe`) and then runs `hugo`,
     whose wrapper self-installs the pinned binary: that path checks no approval
     here (Docsy's does, through its rebuild step).