diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f75496d..fd5770e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,7 @@ name: GitHub CI
 on:
   pull_request:
   push:
+  workflow_dispatch:
   schedule:
     - cron: 0 0 * * 0
 
@@ -10,6 +11,13 @@ defaults:
   run:
     shell: 'bash -Eeuo pipefail -x {0}'
 
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
 
   generate-jobs:
@@ -26,8 +34,11 @@ jobs:
           strategy="$("$BASHBREW_SCRIPTS/github-actions/generate.sh")"
           strategy="$(.github/workflows/munge.sh -c <<<"$strategy")"
           strategy="$("$BASHBREW_SCRIPTS/github-actions/munge-i386.sh" -c <<<"$strategy")"
-          echo "strategy=$strategy" >> "$GITHUB_OUTPUT"
-          jq . <<<"$strategy" # sanity check / debugging aid
+
+          EOF="EOF-$RANDOM-$RANDOM-$RANDOM"
+          echo "strategy<<$EOF" >> "$GITHUB_OUTPUT"
+          jq <<<"$strategy" . | tee -a "$GITHUB_OUTPUT"
+          echo "$EOF" >> "$GITHUB_OUTPUT"
 
   test:
     needs: generate-jobs