diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 451ecdd..b5109da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,13 @@ on:
   push:
     branches: [ main ]
   pull_request:
-    types: [opened, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
@@ -14,20 +20,16 @@ jobs:
         node: [24]
     timeout-minutes: 30
     steps:
-      - name: checkout pushed commit
-        uses: actions/checkout@v6
+      - name: checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
-      - name: cache dependencies
-        uses: actions/cache@v5
-        with:
-          path: | 
-            node_modules
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
+          cache: yarn
+          cache-dependency-path: yarn.lock
       - name: install dependencies
         run: yarn install --frozen-lockfile
       - name: typecheck