diff --git a/.github/workflows/check-migrations.yml b/.github/workflows/check-migrations.yml
index 412bbc7f25..512ab7e5af 100644
--- a/.github/workflows/check-migrations.yml
+++ b/.github/workflows/check-migrations.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+# drop permissions for default token
+permissions: {}
+
 jobs:
   runtime-matrix:
     runs-on: ubuntu-latest
@@ -51,13 +54,19 @@ jobs:
           chmod +x ./try-runtime
 
       - name: Install Protoc
-        uses: arduino/setup-protoc@v1
+        uses: arduino/setup-protoc@149f6c87b92550901b26acd1632e11c3662e381f # v1.3.0
         with:
           version: "3.6.1"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Add wasm32-unknown-unknown target
         run: rustup target add wasm32-unknown-unknown
 
+      - name: Fetch cache
+        uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2.7.0
+        with:
+          shared-key: "fellowship-cache-migrations"
+
       - name: Build ${{ matrix.runtime.name }}
         run: |
           cargo build --profile production -p ${{ matrix.runtime.package }} --features try-runtime -q --locked
diff --git a/.github/workflows/clippy.yml b/.github/workflows/clippy.yml
index 5f4bed4e9f..dca36a130d 100644
--- a/.github/workflows/clippy.yml
+++ b/.github/workflows/clippy.yml
@@ -2,11 +2,16 @@ name: "Clippy"
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
   workflow_dispatch:
 
+# cancel previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   clippy:
     runs-on: ubuntu-22.04
@@ -28,7 +33,7 @@ jobs:
       - name: Fetch cache
         uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2.7.0
         with:
-          shared-key: "fellowship-cache"
+          shared-key: "fellowship-cache-clippy"
 
       - name: Clippy
         run: cargo +nightly clippy --all-targets --locked -q
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 480f10527a..32259e51c8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,11 +2,16 @@ name: "Test all features"
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
   workflow_dispatch:
 
+# cancel previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-22.04
@@ -51,7 +56,7 @@ jobs:
       - name: Fetch cache
         uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2.7.0
         with:
-          shared-key: "fellowship-cache"
+          shared-key: "fellowship-cache-tests"
 
       - name: Test
         run: cargo test --workspace --release --locked -q --features=runtime-metrics,try-runtime