diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index 6a12f41..e58214e 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -56,6 +56,19 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # Serialise per deploy target so two pushes cannot deploy over each other.
+    # The target is the stack selector, NOT stack-name: a multi-account app can
+    # call this workflow from several jobs in one run (seahaven-org-baseline
+    # runs five, one per AWS account) and stack-name is optional, so keying on
+    # it alone would collapse the selector-only jobs into one group and
+    # serialise deploys that are genuinely independent. `stacks` always defaults
+    # to "--all", so the group is never empty and back-to-back deploys of the
+    # same target still queue.
+    # cancel-in-progress is FALSE on purpose: unlike CI, aborting midway can
+    # leave a stack mid-update.
+    concurrency:
+      group: cd-cdk-${{ inputs.region }}-${{ inputs.stacks }}-${{ inputs.stack-name }}
+      cancel-in-progress: false
     steps:
       - uses: actions/checkout@v7
 
diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml
index 56a91ea..39db5c6 100644
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@@ -56,6 +56,15 @@ jobs:
   deploy-ios:
     runs-on: macos-26
     timeout-minutes: ${{ inputs.timeout-minutes }}
+    # Serialise per app + lane so two pushes cannot upload over each other.
+    # There is no app-identifier input: the target is whatever Fastfile lives in
+    # working-directory, so that plus the lane is what identifies the deploy.
+    # Both always default ("." and "ios beta"), so the group is never empty.
+    # cancel-in-progress is FALSE on purpose: unlike CI, aborting midway can
+    # leave a half-uploaded TestFlight build.
+    concurrency:
+      group: cd-mobile-ios-${{ inputs.working-directory }}-${{ inputs.fastlane-lane }}
+      cancel-in-progress: false
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml
index 249998b..9dc07af 100644
--- a/.github/workflows/cd-sam.yaml
+++ b/.github/workflows/cd-sam.yaml
@@ -39,6 +39,15 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # Serialise per stack so two pushes cannot deploy over each other.
+    # stack-name is required and region always defaults, so the group is never
+    # empty; the pair is exactly what identifies a CloudFormation stack, so
+    # different stacks in the same caller repo still deploy in parallel.
+    # cancel-in-progress is FALSE on purpose: unlike CI, aborting midway can
+    # leave a stack mid-update.
+    concurrency:
+      group: cd-sam-${{ inputs.region }}-${{ inputs.stack-name }}
+      cancel-in-progress: false
     steps:
       - uses: actions/checkout@v7