diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
index 27fcca9..596e77d 100644
--- a/.github/workflows/pages-deploy.yml
+++ b/.github/workflows/pages-deploy.yml
@@ -17,10 +17,6 @@ permissions:
   actions: read
   contents: read
 
-concurrency:
-  group: pages-main
-  cancel-in-progress: true
-
 jobs:
   identity:
     name: Resolve trusted production identity
@@ -70,6 +66,9 @@ jobs:
   deploy:
     name: Deploy checked website artifact
     needs: identity
+    concurrency:
+      group: pages-main
+      cancel-in-progress: true
     permissions:
       actions: read
       contents: read
diff --git a/tasks/vitepress-documentation-site/implementation-plan.md b/tasks/vitepress-documentation-site/implementation-plan.md
index 316eb62..469e4c7 100644
--- a/tasks/vitepress-documentation-site/implementation-plan.md
+++ b/tasks/vitepress-documentation-site/implementation-plan.md
@@ -227,6 +227,11 @@ GitHub preparation completed on 2026-07-28: the selected organization secrets no
 deployments only from `main`. The workflow remains responsible for idempotently reconciling the
 Cloudflare Pages project and custom domain.
 
+The first production run exposed an ordering property of `workflow_run`: a Dependabot pull
+request completion can start the delivery controller even when its identity job will be skipped.
+Keep production concurrency on the deploy job, after trusted-main identity resolution, so an
+ineligible controller run cannot cancel an active production deployment.
+
 When the first published route moves, add its direct permanent redirect under
 `website/content/public/_redirects` and verify both old and new URLs. Do not add custom global
 cache rules until measured behavior requires them.