diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 257545428..f2157acc9 100755
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,6 +3,10 @@ name: Build
 on:
   pull_request:
     branches: [main]
+    # ready_for_review is included so that marking a draft PR "Ready for
+    # review" triggers a build (the draft guard below skips draft PRs);
+    # it is not in GitHub's default set (opened/synchronize/reopened).
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - 'components/**'
       - 'external/**'
@@ -10,8 +14,27 @@ on:
       - '!**/idf_component.yml'
       - '!**/README.md'
 
+# Least-privilege default: these jobs only check out the repo and build/upload
+# artifacts, so read-only access to repository contents is sufficient.
+permissions:
+  contents: read
+
+# Supersede in-progress runs: a new commit on the same PR cancels the earlier,
+# now-stale build. Keyed by the workflow (so it never cross-cancels other
+# workflows) + the PR number, which is globally unique - unlike the head branch
+# name, two fork PRs can't collide on it. For non-PR events (push, release) we
+# fall back to github.run_id, which is unique per run, so those runs each get
+# their own group and never serialize or cancel each other.
+# cancel-in-progress is gated to pull_request events only so that push-to-main
+# runs are never cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
+    # Skip build CI for draft PRs; still runs on push-to-main and non-draft PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
 
     runs-on: ubuntu-latest
     continue-on-error: true
diff --git a/.github/workflows/build_libraries.yml b/.github/workflows/build_libraries.yml
index 8cc5645e5..8c4806103 100644
--- a/.github/workflows/build_libraries.yml
+++ b/.github/workflows/build_libraries.yml
@@ -3,14 +3,37 @@ name: Build Host C++ / Python Libraries
 on:
   pull_request:
     branches: [main]
+    # ready_for_review is included so that marking a draft PR "Ready for
+    # review" triggers a build (the draft guard below skips draft PRs);
+    # it is not in GitHub's default set (opened/synchronize/reopened).
+    types: [opened, synchronize, reopened, ready_for_review]
   push:
     branches: [main]
   release:
     types: [published]
   workflow_dispatch:
 
+# Least-privilege default: these jobs only check out the repo and build/upload
+# artifacts, so read-only access to repository contents is sufficient.
+permissions:
+  contents: read
+
+# Supersede in-progress runs: a new commit on the same PR cancels the earlier,
+# now-stale build. Keyed by the workflow (so it never cross-cancels other
+# workflows) + the PR number, which is globally unique - unlike the head branch
+# name, two fork PRs can't collide on it. For non-PR events (push, release) we
+# fall back to github.run_id, which is unique per run, so those runs each get
+# their own group and never serialize or cancel each other.
+# cancel-in-progress is gated to pull_request events only so that push-to-main
+# (and release) runs are never cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build_windows:
+    # Skip build CI for draft PRs; still runs on push-to-main and non-draft PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
 
     runs-on: windows-latest
     continue-on-error: false
@@ -42,6 +65,8 @@ jobs:
         path: lib/pc
 
   build_linux:
+    # Skip build CI for draft PRs; still runs on push-to-main and non-draft PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
 
     runs-on: ubuntu-latest
     continue-on-error: false
@@ -70,6 +95,8 @@ jobs:
         path: lib/pc
 
   build_macos:
+    # Skip build CI for draft PRs; still runs on push-to-main and non-draft PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
 
     runs-on: macos-latest
     continue-on-error: false
diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml
index dce044e31..122b731af 100644
--- a/.github/workflows/build_wheels.yml
+++ b/.github/workflows/build_wheels.yml
@@ -3,6 +3,10 @@ name: Build Python Wheels
 on:
   pull_request:
     branches: [main]
+    # ready_for_review is included so that marking a draft PR "Ready for
+    # review" triggers a build (the draft guard below skips draft PRs);
+    # it is not in GitHub's default set (opened/synchronize/reopened).
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - 'lib/**'
       - 'components/**'
@@ -19,9 +23,23 @@ on:
 permissions:
   contents: read
 
+# Supersede in-progress runs: a new commit on the same PR cancels the earlier,
+# now-stale build. Keyed by the workflow (so it never cross-cancels other
+# workflows) + the PR number, which is globally unique - unlike the head branch
+# name, two fork PRs can't collide on it. For non-PR events (push, release) we
+# fall back to github.run_id, which is unique per run, so those runs each get
+# their own group and never serialize or cancel each other.
+# cancel-in-progress is gated to pull_request events only so that push-to-main
+# (and release) runs are never cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build_wheels:
     name: Build wheels on ${{ matrix.os }}
+    # Skip build CI for draft PRs; still runs on push-to-main and non-draft PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -53,6 +71,8 @@ jobs:
 
   build_sdist:
     name: Build source distribution
+    # Skip build CI for draft PRs; still runs on push-to-main and non-draft PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
 
     steps: