diff --git a/.ci-policy.md b/.ci-policy.md
new file mode 100644
index 0000000000..b4fa4811ff
--- /dev/null
+++ b/.ci-policy.md
@@ -0,0 +1 @@
+CodeQL scans main hourly to batch frequent docs-sync changes; PR/manual scans remain enabled and deployment/release gates are unchanged.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6bb1af182d..f3ed65fdb4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,13 +2,15 @@ name: CodeQL
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
   schedule:
-    - cron: "41 4 * * 1"
+    - cron: "11 * * * *"
   workflow_dispatch:
 
+# Keep scheduled scans running; only superseded PR scans should be cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || (github.event_name == 'schedule' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   actions: read
   contents: read