diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 308663ffe0..c247a0a6a9 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -6,39 +6,86 @@ name: Validate Docs
 
 on: [pull_request]
 
+# A new push supersedes the run before it.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: 24
+
 jobs:
-  test:
-    name: Test on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        # Build processes work differently across operating systems, so the
-        # checks run on each one to make sure anyone can contribute to the
-        # docs.
-        os: [windows-latest, macOS-latest]
+  # Needs no dependencies, so it reports in seconds rather than queueing behind
+  # npm ci and lint.
+  admonitions:
+    name: Check Admonitions
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        # The check diffs against the pull request base, so it needs history.
+        fetch-depth: 0
+    - uses: ./.github/workflows/actions/check-admonitions
+
+  # These produce the same verdict on any operating system, so they run once.
+  checks:
+    name: Checks
+    runs-on: ubuntu-latest
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: ⚙️ Use Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: 24
+        node-version: ${{ env.NODE_VERSION }}
+        cache: npm
     - name: 🕸️ Install Dependencies
       run: npm ci
-    - name: 🖌️ Lint
-      run: npm run lint
     - name: Test
       run: npm run test
     - name: 🧩 Typecheck
       run: npm run typecheck
     - name: 🔤 Spell Check
       run: npm run spellcheck
-    - uses: ./.github/workflows/actions/check-admonitions
     - uses: ./.github/workflows/actions/check-translations
-    # Lint and spell check changes should be pushed
-    # to the branch before the branch is merge eligible.
-    #
-    # The translation keys check should not produce any changes.
+
+  cross-platform:
+    name: Cross-platform on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        # Prettier rewrites line endings, so Lint is the one check whose
+        # verdict depends on the operating system.
+        os: [windows-latest, macOS-latest]
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: ⚙️ Use Node.js
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: ${{ env.NODE_VERSION }}
+        cache: npm
+    - name: 🕸️ Install Dependencies
+      run: npm ci
+    - name: 🖌️ Lint
+      run: npm run lint
+    # Lint changes should be pushed to the branch before the branch is merge
+    # eligible.
     - name: 🔍 Check Diff
       run: git diff --exit-code
       shell: bash
+
+  verify:
+    # The one required check on main and the feature branches, so the jobs
+    # above can change without touching the protection rules. Renaming this
+    # blocks merges until those rules are updated to match.
+    name: Verify
+    if: ${{ always() }}
+    needs: [admonitions, checks, cross-platform]
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Check job status
+      if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+      run: exit 1
diff --git a/.github/workflows/actions/check-admonitions/action.yml b/.github/workflows/actions/check-admonitions/action.yml
index e3f4bf6948..8cd33474a5 100644
--- a/.github/workflows/actions/check-admonitions/action.yml
+++ b/.github/workflows/actions/check-admonitions/action.yml
@@ -15,17 +15,14 @@ runs:
     # Only the files the pull request touches are checked, so an existing
     # page is never anyone else's problem to fix.
     #
-    # The event payload has no file list, so the changed files come from a
-    # diff. The checkout is shallow and the base commit is fetched here
-    # rather than through `fetch-depth` on the checkout, which would pull
-    # the full history for every step in the job just to serve this one.
+    # The caller has to check out with `fetch-depth: 0`, which a composite
+    # action cannot require for itself.
     - name: 🔎 Check Admonitions
       shell: bash
       env:
         BASE_SHA: ${{ github.event.pull_request.base.sha }}
         CHANGED_FILES: ${{ runner.temp }}/changed-files.txt
       run: |
-        git fetch --quiet --no-tags --depth=1 origin "$BASE_SHA"
         git diff --name-only --diff-filter=ACMR "$BASE_SHA" HEAD > "$CHANGED_FILES"
         node <<'JS'
         const { readFileSync } = require('fs');