diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 65aaea6e..5745d20f 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -5,13 +5,24 @@ on:
   push:
     branches: [main]
 
+# A branch that gets three pushes in a minute ran three full jobs, and the two
+# that no longer describe anything were still occupying runners.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Without this the job's token carries whatever the repository default grants.
+# Nothing here writes anything.
+permissions:
+  contents: read
+
 jobs:
   verify:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '25'