diff --git a/.github/workflows/cancel_workflows.yml b/.github/workflows/cancel_workflows.yml
new file mode 100644
index 00000000..3574d03b
--- /dev/null
+++ b/.github/workflows/cancel_workflows.yml
@@ -0,0 +1,17 @@
+name: Cancel duplicate workflows
+
+on:
+  workflow_run:
+    workflows: ["CI", "CodeQL"]
+    types:
+      - requested
+
+# Note: This has to be in workflow_run so it works for PRs from forks.
+jobs:
+  cancel:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Cancel previous runs
+      uses: styfle/cancel-workflow-action@3d86a7cc43670094ac248017207be0295edbc31d  # 0.8.0
+      with:
+        workflow_id: ${{ github.event.workflow.id }}
diff --git a/.github/workflows/ci_workflows.yml b/.github/workflows/ci_workflows.yml
index 71389ffc..1f64b185 100644
--- a/.github/workflows/ci_workflows.yml
+++ b/.github/workflows/ci_workflows.yml
@@ -9,7 +9,7 @@ on:
     - cron: '0 6 * * 2'
 
 jobs:
-  cancel_ci:
+  initial_checks:
     name: Mandatory checks before CI
     runs-on: ubuntu-latest
     steps:
@@ -25,17 +25,12 @@ jobs:
           } else {
             core.info(`PR opened correctly against ${allowed_basebranch}`);
           }
-    # TODO: Fix this for PRs
-    - name: Cancel Previous Runs
-      uses: styfle/cancel-workflow-action@ce177499ccf9fd2aded3b0426c97e5434c2e8a73
-      with:
-        access_token: ${{ secrets.GITHUB_TOKEN }}
 
   # The rest only run if above are done
 
   pep_and_audit:
     runs-on: ubuntu-latest
-    needs: cancel_ci
+    needs: initial_checks
     steps:
     - name: Checkout code
       uses: actions/checkout@v2
@@ -62,7 +57,7 @@ jobs:
 
   link_check:
     runs-on: ubuntu-latest
-    needs: cancel_ci
+    needs: initial_checks
     steps:
     - name: Checkout code
       uses: actions/checkout@v2
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ad0a73a8..cbaa1fe7 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -19,21 +19,8 @@ on:
     branches: [ master ]
 
 jobs:
-  cancel_ci:
-    name: Mandatory checks before CI
-    runs-on: ubuntu-latest
-    steps:
-    # TODO: Fix this for PRs
-    - name: Cancel Previous Runs
-      uses: styfle/cancel-workflow-action@ce177499ccf9fd2aded3b0426c97e5434c2e8a73
-      with:
-        access_token: ${{ secrets.GITHUB_TOKEN }}
-
-  # The rest only run if above are done
-
   analyze:
     name: Analyze
-    needs: cancel_ci
     runs-on: ubuntu-latest
 
     strategy: