diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c50a8af..f78030e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 name: ci
+
 on:
   push:
     branches:
@@ -22,6 +23,21 @@ on:
   pull_request:
     branches:
       - main
+  # Support merge queues.
+  merge_group:
+    types:
+      - checks_requested
+  # Allow manual invocation – useful for debugging.
+  workflow_dispatch:
+
+# Cancel any previously-started but still active runs on the same branch.
+concurrency:
+  cancel-in-progress: true
+  group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
+
+# Declare default permissions as read-only.
+permissions: read-all
+
 jobs:
   build_dist:
     runs-on: ${{ matrix.os_dist.os }}