diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 80a71a1..921f59d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,12 @@ on:
     branches: [main]
     tags: ["v*"]
 
+# Only one publish run per ref at a time; a newer push cancels an in-flight
+# build for the same ref instead of letting it hang/queue behind it.
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   publish:
     name: Build and push to GHCR
@@ -35,7 +41,14 @@ jobs:
             type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' }}
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
+      # Pin a recent QEMU build. The default binfmt image lagged the toolchain
+      # in node:22-alpine (gcc 15 / musl 1.2.6), and emulating those newer
+      # arm64 binaries crashed with "uncaught target signal 4 (Illegal
+      # instruction)", which core-dumped and left the build hung. A current
+      # QEMU emulates the new userspace correctly.
       - uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v10.2.3
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR