diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94da45ec..34de1d8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,18 +10,32 @@ on:
       - main
       - next
 
+permissions:
+  checks: write
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   ci:
     runs-on: ${{ matrix.os }}
 
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest]
         node: [16]
 
     steps:
-      - name: Checkout latest code
-        uses: actions/checkout@master
+      - name: Check out repository (push)
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
+        uses: actions/checkout@v2
+
+      - name: Check out repository (pull_request_target)
+        if: ${{ github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]' }}
+        uses: actions/checkout@v2
         with:
           ref: ${{ github.event.pull_request.head.sha }}