diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 6d18a1c..9bf51ad 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -6,6 +6,10 @@ on:
     branches: [main]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 permissions:
   contents: read
 
@@ -13,20 +17,26 @@ jobs:
   secrets:
     name: Secret Scan - Gitleaks
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
       - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   trivy:
     name: Vulnerability and IaC Scan - Trivy
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       security-events: write
       actions: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .trivy-cache
           key: trivy-${{ runner.os }}-${{ github.run_id }}
@@ -40,7 +50,7 @@ jobs:
           format: sarif
           output: trivy.sarif
           cache-dir: .trivy-cache
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         if: always()
         with:
           sarif_file: trivy.sarif
diff --git a/README.md b/README.md
index dddc8d3..0bb56d3 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ A template repository for bootstrapping secure GitHub projects. Copy these files
 
 | File | Purpose |
 |------|---------|
-| `.github/workflows/security.yml` | CI pipeline: secret scanning (Gitleaks) + vulnerability/IaC scanning (Trivy) on every push and PR |
+| `.github/workflows/security.yml` | CI pipeline: secret scanning (Gitleaks) + vulnerability/IaC scanning (Trivy); triggers on push, PR, and manual dispatch; Trivy findings uploaded to the GitHub Security tab; stale PR runs cancelled automatically |
 | `.github/dependabot.yml` | Weekly automated dependency updates for GitHub Actions, Terraform, and Docker |
 | `.gitleaks.toml` | Gitleaks configuration; add allowlist entries for test fixtures here |
 | `.trivyignore` | Document accepted CVEs here with justification |