diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b8dce10a..4f29a5e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,11 +21,14 @@ on:
 permissions:
   contents: read
 
-# Cancel superseded runs of a pull request; runs for pushes get their own
-# group, so that runs for successive pushes are not dropped. Runs for edits
-# that leave the title unchanged (e.g. of the description, also by bots)
-# share a group of their own, so that they cancel each other but not the
-# run for the pull request's commit
+# Only a new head commit of a pull request cancels its runs in progress
+# (action `synchronize`, first attempt); runs for other actions and reruns
+# wait, so that a run on the same commit never leaves a cancelled, failed
+# `CI passed` (see "Cancelled runs" in `actions/gate/README.md` of
+# `elixir-cloud-aai/.github`). Runs for pushes get their own group, so that
+# none is dropped. Runs for edits that leave the title unchanged (e.g. of
+# the description, also by bots) share a group of their own, so that they
+# don't wait for the run for the pull request's commit
 concurrency:
   group: >-
     ${{ github.workflow }}-${{
@@ -33,7 +36,10 @@ concurrency:
       github.event.action == 'edited' && !github.event.changes.title &&
         format('{0}-edited', github.ref) ||
       github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: >-
+    ${{ github.event_name == 'pull_request'
+    && github.event.action == 'synchronize'
+    && github.run_attempt == 1 }}
 
 jobs: