diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7379336..dc2e77e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -18,13 +18,33 @@ on:
   # Manual re-run, e.g. after rotating a credential or raising a budget cap.
   workflow_dispatch:
 
+# A newer run for the same PR or branch cancels the one it supersedes: there
+# is one runner, so a stale run would hold it (and the GPU) to the end. Adding
+# a label other than e2e:full starts a run whose jobs all skip; it gets a
+# group of its own, so it can't cancel the real one.
+#
+# Gitea triggers on `labeled` but hands the workflow its own name for the
+# action, `label_updated` (and `synchronized` for a push), so each check
+# below accepts both. Nor does it say which label was added
+# (`github.event.label` is empty), so a label event counts when the PR now
+# has e2e:full; adding another label to an e2e:full PR restarts its run.
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{ github.head_ref || github.ref }}${{
+    ((github.event.action == 'labeled' || github.event.action == 'label_updated')
+    && !contains(github.event.pull_request.labels.*.name, 'e2e:full'))
+    && format('-label-{0}', github.run_id) || '' }}
+  cancel-in-progress: true
+
 env:
   # Full on e2e:full, and outside PRs.
   FULL: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'e2e:full') }}
 
 jobs:
   checks:
-    if: github.event.action != 'labeled' || github.event.label.name == 'e2e:full'
+    if: >-
+      (github.event.action != 'labeled' && github.event.action != 'label_updated')
+      || contains(github.event.pull_request.labels.*.name, 'e2e:full')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -76,13 +96,13 @@ jobs:
     # services, every role on a local model, so it spends nothing but keeps
     # the RTX 4090 busy: ~10 minutes for the smoke tests, ~25+ for all. On
     # PRs and manual runs, and only after the checks pass: a PR that's red
-    # already doesn't spend the GPU. There is one runner and Gitea doesn't
-    # honour cancel-in-progress, so a run a newer push supersedes holds the
-    # runner until it's cancelled by hand. Locally, run only what you're
-    # writing (-k) or diagnosing (--lf).
+    # already doesn't spend the GPU. A newer push cancels a run it supersedes
+    # (concurrency, above). Locally, run only what you're writing (-k) or
+    # diagnosing (--lf).
     if: >-
       github.event_name != 'push'
-      && (github.event.action != 'labeled' || github.event.label.name == 'e2e:full')
+      && ((github.event.action != 'labeled' && github.event.action != 'label_updated')
+      || contains(github.event.pull_request.labels.*.name, 'e2e:full'))
     needs: checks
     runs-on: ubuntu-latest
     timeout-minutes: 90
diff --git a/docs/Development-Plan.md b/docs/Development-Plan.md
index 5642448..0d7b692 100644
--- a/docs/Development-Plan.md
+++ b/docs/Development-Plan.md
@@ -81,8 +81,8 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
   runs that full set before its image is built. The end-to-end tests drive the
   real agent, every role on a local model (so they cost nothing per call), in a
   repository of the run's own, with a scripted operator; CI runs them after the
-  checks pass. There is one runner, and a run a newer push
-  supersedes has to be cancelled by hand. Locally only the tests being written
+  checks pass. There is one runner, so a newer run for a
+  PR or branch cancels the one it supersedes (#126). Locally only the tests being written
   (`-k`) or diagnosed (`--lf`); `scripts/e2e.sh` reports what a run spent. Manual
   live runs are for the new loop's first runs and phase ends. Findings are filed as
   issues and either fixed before moving on or deliberately deferred.