diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 56ed29b..4dc3f31 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -13,8 +13,14 @@ permissions:
   pages: write
   id-token: write
 
+# Keyed by ref, not just "pages". With one shared group a pull-request run and
+# a main deploy compete for the same lane, and cancel-in-progress means the
+# newer one wins: the deploy of #10 was killed 3m22s in by a PR run that
+# started after it, and the site silently stayed on the previous build while
+# every check stayed green. Per ref, a push still cancels its own superseded
+# run, which is the case where cancelling is worth having.
 concurrency:
-  group: pages
+  group: pages-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -91,8 +97,8 @@ jobs:
           for m in parser crawler assembler; do (cd "$m" && "$GOVULNCHECK" ./...); done
 
       # One command runs the whole pipeline: compile the parser, build and
-      # verify each database against its registry row count, compress it, build
-      # the web app, and assemble _site — refusing to continue if a database is
+      # verify each database against its registry row count and size, build the
+      # web app, and assemble _site — refusing to continue if a database is
       # short, an artifact looks truncated, or one is missing entirely.
       - name: Build site
         run: go -C assembler run ./cmd/assemble