diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 540879b..b9be6be 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -8,6 +8,10 @@
 
 name: Build and Test
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
   workflow_dispatch:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3f93be6..c182420 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,11 +19,13 @@ jobs:
     name: Build and Test
     uses: ./.github/workflows/build-and-test.yml
     permissions:
+      contents: read
       checks: write
   nextjsgithubpages:
     name: Deploy Next.js site to GitHub Pages
     needs: buildandtest
     uses: StanfordBDHG/.github/.github/workflows/nextjs-github-pages.yml@v2
+    environment: github-pages
     permissions:
       contents: read
       pages: write
@@ -31,6 +33,7 @@ jobs:
   dockerimage:
     name: Docker Build and Push
     uses: StanfordBDHG/.github/.github/workflows/docker-build-and-push.yml@v2
+    environment: package
     with:
       imageName: stanfordbdhg/nextjstemplate
     permissions: