diff --git a/.github/workflows/manubot.yaml b/.github/workflows/manubot.yaml
index ceba6f7..32be716 100644
--- a/.github/workflows/manubot.yaml
+++ b/.github/workflows/manubot.yaml
@@ -28,6 +28,12 @@ on:
         type: boolean
         description: Use Docker to generate PDF
         default: true
+
+concurrency:
+  # only one run per branch at a time
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   manubot:
     name: Manubot
@@ -45,7 +51,7 @@ jobs:
         shell: bash --login {0}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # fetch entire commit history to support get_rootstock_commit
           fetch-depth: 0
@@ -67,20 +73,20 @@ jobs:
           echo "DEFAULT_BRANCH_REF=refs/heads/$DEFAULT_BRANCH" >> $GITHUB_ENV
           echo "DEFAULT_BRANCH=$DEFAULT_BRANCH"
       - name: Cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ci/cache
           key: ci-cache-${{ github.ref }}
           restore-keys: |
             ci-cache-${{ env.DEFAULT_BRANCH_REF }}
       - name: Install Environment
-        uses: conda-incubator/setup-miniconda@v2
+        uses: conda-incubator/setup-miniconda@v3
         with:
           activate-environment: manubot
           environment-file: build/environment.yml
           auto-activate-base: false
           miniforge-variant: Mambaforge
-          miniforge-version: 'latest'
+          miniforge-version: "latest"
           use-mamba: true
       - name: Install Spellcheck
         if: env.SPELLCHECK == 'true'