diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index ee73864..2e96965 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -1,9 +1,20 @@
 name: check
 on: [push]
+# Free the shared runner: a new push cancels only the same branch's older run.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
+        # Free the shared runner from a hung build.
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # script/cibuild needs no token, so none is left in .git/config.
+              with:
+                  persist-credentials: false
+                  # All history and tags, so git describe finds the version tag.
+                  fetch-depth: 0
             - run: script/cibuild
diff --git a/TODO.md b/TODO.md
index dd8c747..afb5101 100644
--- a/TODO.md
+++ b/TODO.md
@@ -12,7 +12,8 @@
 pre-1.0. No git tags. `main` is the stable branch and `next` the development
 branch, which every PR targets. The frontend and the Go backend ship as one
 Docker image, and the Gitea workflow `.gitea/workflows/check.yml` runs
-`script/cibuild` on every push. Working toward 1.0.0.
+`script/cibuild` on every push, and cancels the older run on the same branch.
+Working toward 1.0.0.
 
 # Next Step
 
@@ -21,6 +22,14 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `.gitea/workflows/check.yml` is the sneak/prompts copy at
+  `0653579` ([#153](https://git.eeqj.de/sneak/netwatch/issues/153)). Its
+  checkout step sets `fetch-depth: 0`, so CI clones all history and tags, and
+  `git describe` in `script/cibuild` gives the image built from a tagged commit
+  the tag as its version; it gave the short commit. The checkout step also sets
+  `persist-credentials: false`, so the job's token is not left in `.git/config`.
+  A new push cancels the older run on the same branch, and a run stops after 20
+  minutes
 - 2026-10-19: `script/bootstrap` keeps the `yarn` on `PATH` only when
   `yarn --version` is exactly `YARN_VERSION`, and otherwise installs that
   version as it did when no yarn was installed