diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 91bf575..04a7cd2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,6 @@
 name: ci
 
 on:
-  workflow_dispatch:
   push:
     branches: ["main"]
   pull_request:
@@ -9,11 +8,21 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
+# One active run per ref. On PRs, newer pushes cancel older in-progress runs;
+# on main, runs queue instead so an in-flight publish/deploy always finishes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+  packages: write
+
 jobs:
-  build-push-deploy:
+  image:
+    name: Build image
     runs-on: ubuntu-latest
-    permissions:
-      packages: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -30,7 +39,7 @@ jobs:
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
-          username: ${{ github.repository_owner }}
+          username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
@@ -42,17 +51,28 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          push: ${{ github.event_name != 'pull_request' }}
+          context: .
           platforms: linux/amd64,linux/arm64
+          pull: true
+          # Attestations show up as extra unknown/unknown entries in the manifest.
+          provenance: false
+          push: ${{ github.event_name != 'pull_request' && github.repository == 'icerpc/hello' }}
           tags: |
             icerpc/hello:latest
+            ghcr.io/icerpc/hello:${{ github.sha }}
             ghcr.io/icerpc/hello:latest
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  deploy:
+    name: Deploy
+    needs: image
+    if: github.event_name != 'pull_request' && github.repository == 'icerpc/hello'
+    runs-on: ubuntu-latest
+
+    steps:
       - name: Deploy
         uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        if: github.event_name != 'pull_request'
         with:
           host: ${{ secrets.HELLO_HOST }}
           username: ${{ secrets.HELLO_USERNAME }}
@@ -63,11 +83,16 @@ jobs:
             docker compose up -d hello-icerpc
             docker system prune -f
 
-      - name: Delete old container images
-        if: github.event_name != 'pull_request'
+  cleanup:
+    name: Cleanup old images
+    needs: image
+    if: github.event_name != 'pull_request' && github.repository == 'icerpc/hello'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete old container images (keep the 10 most recent)
         uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
         with:
           package-name: hello
           package-type: container
           min-versions-to-keep: 10
-          delete-only-untagged-versions: true