diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7379336..e7ec349 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -18,6 +18,17 @@ on:
   # Manual re-run, e.g. after rotating a credential or raising a budget cap.
   workflow_dispatch:
 
+# A newer run for the same PR or branch cancels the one it supersedes: there
+# is one runner, so a stale run would hold it (and the GPU) to the end. Adding
+# a label other than e2e:full starts a run whose jobs all skip; it gets a
+# group of its own, so it can't cancel the real one.
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{ github.head_ref || github.ref }}${{
+    (github.event.action == 'labeled' && github.event.label.name != 'e2e:full')
+    && format('-label-{0}', github.run_id) || '' }}
+  cancel-in-progress: true
+
 env:
   # Full on e2e:full, and outside PRs.
   FULL: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'e2e:full') }}
@@ -76,10 +87,9 @@ jobs:
     # services, every role on a local model, so it spends nothing but keeps
     # the RTX 4090 busy: ~10 minutes for the smoke tests, ~25+ for all. On
     # PRs and manual runs, and only after the checks pass: a PR that's red
-    # already doesn't spend the GPU. There is one runner and Gitea doesn't
-    # honour cancel-in-progress, so a run a newer push supersedes holds the
-    # runner until it's cancelled by hand. Locally, run only what you're
-    # writing (-k) or diagnosing (--lf).
+    # already doesn't spend the GPU. A newer push cancels a run it supersedes
+    # (concurrency, above). Locally, run only what you're writing (-k) or
+    # diagnosing (--lf).
     if: >-
       github.event_name != 'push'
       && (github.event.action != 'labeled' || github.event.label.name == 'e2e:full')