diff --git a/.github/workflows/ci-python-app.yaml b/.github/workflows/ci-python-app.yaml
index 006a7bc..b829498 100644
--- a/.github/workflows/ci-python-app.yaml
+++ b/.github/workflows/ci-python-app.yaml
@@ -50,6 +50,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - uses: actions/checkout@v7
 
@@ -96,6 +99,9 @@ jobs:
     if: ${{ inputs.collect-only }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - uses: actions/checkout@v7
 
@@ -117,6 +123,9 @@ jobs:
     if: ${{ inputs.subproject-dir != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - uses: actions/checkout@v7
 
@@ -140,6 +149,9 @@ jobs:
     needs: [lint, test-collect, subproject-tests]
     if: always()
     runs-on: ubuntu-latest
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - name: Require all jobs to have succeeded
         run: |
diff --git a/workflow-templates/sam-deploy.yml b/workflow-templates/sam-deploy.yml
index f24cc70..c734753 100644
--- a/workflow-templates/sam-deploy.yml
+++ b/workflow-templates/sam-deploy.yml
@@ -8,8 +8,10 @@ jobs:
     uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@main
     with:
       # Required: the CloudFormation stack name (kebab-case, matches repo name).
-      stack-name: $default-branch
+      # NOTE: this is a literal placeholder on purpose — starter-workflow variables
+      # like $default-branch substitute to the BRANCH name ("main"), not the repo name.
+      stack-name: REPLACE-ME-stack-name
       # Required: the CloudFormation execution role ARN for this stack.
-      cfn-role-arn: arn:aws:iam::328440206208:role/REPLACE-ME-cfn-exec-role
+      cfn-role-arn: arn:aws:iam::328440206208:role/github-cfn-execution-role
     secrets:
       deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}