diff --git a/.github/workflows/crates-release.yml b/.github/workflows/crates-release.yml
index a6bf2310c..9a5ae4afe 100644
--- a/.github/workflows/crates-release.yml
+++ b/.github/workflows/crates-release.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install nix
@@ -50,7 +50,7 @@ jobs:
       prerelease: ${{ steps.meta.outputs.prerelease }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fetch master
@@ -112,7 +112,7 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install toolchain
         uses: dtolnay/rust-toolchain@stable
       - name: Use cache
@@ -133,7 +133,7 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: cargo publish --locked -p "$CRATE"
       - name: Upload packaged crate
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: crate
           path: target/package/${{ needs.verify-tag.outputs.crate }}-${{ needs.verify-tag.outputs.version }}.crate
@@ -150,13 +150,13 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/determinate-nix-action@main
       - name: Use nix cache
         uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Download packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: crate
           path: dist
@@ -193,13 +193,13 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/determinate-nix-action@main
       - name: Use nix cache
         uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Download packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: crate
           path: dist
diff --git a/.github/workflows/cron-directory-monitor.yml b/.github/workflows/cron-directory-monitor.yml
index 15e63110e..615e414b7 100644
--- a/.github/workflows/cron-directory-monitor.yml
+++ b/.github/workflows/cron-directory-monitor.yml
@@ -6,6 +6,6 @@ jobs:
   health-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check /health endpoint
         run: cd payjoin-mailroom && bash contrib/health-check.sh
diff --git a/.github/workflows/cron-weekly-mutants.yml b/.github/workflows/cron-weekly-mutants.yml
index 1e7ac721b..a5a9170d5 100644
--- a/.github/workflows/cron-weekly-mutants.yml
+++ b/.github/workflows/cron-weekly-mutants.yml
@@ -9,12 +9,12 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-mutants@27.1.0
       - run: cargo mutants --in-place --no-shuffle
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: mutants.out
diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index 2374d1ec1..d6c62e6ea 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -12,17 +12,36 @@ on:
       # the flake change this workflow's environment.
       - flake.nix
       - flake.lock
+  # GitHub Actions caches saved on a pull request branch are invisible to
+  # other pull requests; only caches saved on master are shared. Run the
+  # native asset builds on master so every pull request starts from a warm
+  # cross-compilation cache, and so cross-build breakage is caught after
+  # merge. The test, pack, and smoke jobs stay pull-request-only.
+  push:
+    branches: [master]
+    paths:
+      - payjoin-ffi/**
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build-csharp-and-test-unix:
     name: "Build and test csharp"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
@@ -34,6 +53,9 @@ jobs:
 
   build-csharp-and-test-windows:
     name: "Build and test csharp (windows)"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: windows-latest
     env:
       RUSTUP_TOOLCHAIN: 1.85
@@ -42,7 +64,7 @@ jobs:
         working-directory: payjoin-ffi/csharp
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
 
@@ -50,7 +72,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
@@ -102,7 +124,7 @@ jobs:
             target: x86_64-pc-windows-msvc
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
@@ -111,6 +133,18 @@ jobs:
 
       - name: Use cache
         uses: Swatinem/rust-cache@v2
+        with:
+          # rust-cache derives its key from the job id, toolchain, and
+          # lockfiles, all identical across this matrix, so without an
+          # explicit key the six RIDs race for one cache entry and only
+          # the first finisher's target directory is ever stored.
+          key: ${{ matrix.rid }}
+          # cargo-xwin downloads the MSVC CRT/SDK here on every cold run.
+          cache-directories: ~/.cache/cargo-xwin
+          # Pull request branch caches are invisible to other pull requests
+          # and would duplicate the master entries within the repository's
+          # 10 GB cache budget; only the master seeding runs save.
+          save-if: ${{ github.event_name == 'push' }}
 
       - name: Install cross toolchain
         # Version- and hash-pinned: these tools produce the shipped binaries.
@@ -145,7 +179,7 @@ jobs:
           PAYJOIN_FFI_CROSS=1 PAYJOIN_FFI_RID=${{ matrix.rid }} bash ./scripts/build_nuget_native.sh
 
       - name: Upload NuGet native asset
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.rid }}
           path: payjoin-ffi/csharp/artifacts/runtimes/${{ matrix.rid }}/native/*
@@ -153,6 +187,9 @@ jobs:
 
   pack-nuget:
     name: "Pack C# NuGet package"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: ubuntu-latest
     needs: build-nuget-native
     env:
@@ -164,7 +201,7 @@ jobs:
         working-directory: payjoin-ffi/csharp
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
@@ -173,12 +210,12 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Download native assets
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: payjoin-ffi/csharp/artifacts/downloaded
 
@@ -197,7 +234,7 @@ jobs:
         run: dotnet pack Payjoin.csproj --configuration Release --output artifacts/packages
 
       - name: Upload NuGet package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: payjoin-csharp-nuget-package
           path: payjoin-ffi/csharp/artifacts/packages/*.nupkg
@@ -227,15 +264,15 @@ jobs:
             rid: win-x64
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Download NuGet package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: payjoin-csharp-nuget-package
           path: payjoin-ffi/csharp/artifacts/packages
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index 115af707b..b8bb4a2c9 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-dart-and-test:
     name: "Build and test dart"
@@ -22,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index b642adb0e..a4ff24903 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -1,11 +1,30 @@
 name: Flake Check
 
+# See rust.yml for why push events are restricted to master.
 on:
   push:
+    branches: [master]
   pull_request:
     types: [opened, synchronize, reopened]
-    paths-ignore:
+    # The msrv, stable, and nightly checks run the same workspace test
+    # suite that rust.yml already runs on every pull request, and the
+    # maintenance check duplicates the Lint and Format jobs. The signal
+    # unique to this workflow is that the nix packaging itself still
+    # works, so on pull requests it only runs when nix-relevant inputs
+    # change. Master pushes always run the full check.
+    paths:
+      - "**/*.nix"
       - "flake.lock"
+      - "Cargo-minimal.lock"
+      - "Cargo-recent.lock"
+      - "rust-toolchain.toml"
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   flake-check:
@@ -19,7 +38,7 @@ jobs:
           - maintenance
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/flake-maintenance.yml b/.github/workflows/flake-maintenance.yml
index e1d450cb1..ab9f0dcf9 100644
--- a/.github/workflows/flake-maintenance.yml
+++ b/.github/workflows/flake-maintenance.yml
@@ -16,7 +16,7 @@ jobs:
           - nightly
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -32,7 +32,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 08c56b316..c1b5e2b99 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,13 +1,24 @@
-name: Continuous integration
+name: Format
 
-on: [push, pull_request]
+# See rust.yml for why push events are restricted to master.
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   Format:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install nix"
         uses: DeterminateSystems/determinate-nix-action@main
       - name: "Use nix cache"
diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml
index c116525ca..0bbba8fe3 100644
--- a/.github/workflows/javascript.yml
+++ b/.github/workflows/javascript.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-js-and-test:
     name: "Build and test javascript"
@@ -22,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
diff --git a/.github/workflows/lock-maintenance.yml b/.github/workflows/lock-maintenance.yml
index 45e1b7e4b..8f3287e40 100644
--- a/.github/workflows/lock-maintenance.yml
+++ b/.github/workflows/lock-maintenance.yml
@@ -13,10 +13,10 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
       - run: bash contrib/update-lock-files.sh
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@v8
         with:
           title: "chore: update cargo.lock"
           commit-message: "chore: update cargo.lock"
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index f66644b9a..400b20642 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-python-and-test:
     name: "Build and test python"
@@ -22,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
index 64a46c340..519ebb5ad 100644
--- a/.github/workflows/release-image.yml
+++ b/.github/workflows/release-image.yml
@@ -9,6 +9,13 @@ on:
       - payjoin-mailroom-[0-9]*
   workflow_dispatch:
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   publish:
     name: "Build and publish Docker image"
@@ -21,7 +28,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -51,14 +58,14 @@ jobs:
       packages: write
     steps:
       - name: Wait for other workflows
-        uses: lewagon/wait-on-check-action@v1.5.0
+        uses: lewagon/wait-on-check-action@v1.9.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           running-workflow-name: "Build and upload image artifact"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -76,7 +83,7 @@ jobs:
           ls -lh payjoin-mailroom-${TAG}.tar
 
       - name: Upload image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: payjoin-mailroom-image-${{ github.sha }}
           path: payjoin-mailroom-*.tar
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 5c3bb758f..782d8edb1 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -1,6 +1,20 @@
 name: Continuous integration
 
-on: [push, pull_request]
+# Pull requests from branches in this repository would otherwise trigger
+# both a push and a pull_request run for every commit; restricting push
+# events to master keeps one run per change while still producing the
+# master check runs the release workflow waits on.
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   Test:
@@ -20,7 +34,7 @@ jobs:
       RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install ${{ matrix.rust }} toolchain"
         uses: dtolnay/rust-toolchain@master
         with:
@@ -37,6 +51,13 @@ jobs:
           echo "$(nix build .#nginx-with-stream --print-out-paths --no-link)/bin" >> $GITHUB_PATH
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: Run tests
         run: RUST_LOG=debug bash contrib/test.sh
 
@@ -44,9 +65,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: "Install nix"
         uses: DeterminateSystems/determinate-nix-action@main
       - name: "Use nix cache"
@@ -69,7 +97,7 @@ jobs:
       RUSTUP_TOOLCHAIN: stable
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install toolchain"
         # rust-cache usage with stable Rust is most effective, as a cache is tied to the Rust version
         uses: dtolnay/rust-toolchain@stable
@@ -83,6 +111,13 @@ jobs:
           echo "$(nix build .#nginx-with-stream --print-out-paths --no-link)/bin" >> $GITHUB_PATH
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: "Install cargo-llvm-cov"
         uses: taiki-e/install-action@cargo-llvm-cov
       - name: "Generate code coverage for tests"
@@ -96,17 +131,20 @@ jobs:
     name: Code spell check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: codespell-project/actions-codespell@v2
 
   DiffMutants:
     name: Diff cargo-mutants
+    # The diff is taken against the pull request base branch; on other
+    # events base_ref is empty and the job mutates an empty diff.
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     env:
       RUSTUP_TOOLCHAIN: stable
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # required for full diff context
       - name: Fetch base branch for diff
@@ -122,12 +160,19 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # This job only runs on pull requests, so it can never save a
+          # cache that other branches could see. Restore the stable Test
+          # job's master cache instead of keeping a per-branch copy; both
+          # jobs build the workspace with the stable toolchain.
+          shared-key: Test
+          save-if: false
       - name: Run cargo-mutants on diff
         run: >
           cargo mutants --no-shuffle --in-diff git.diff
           --test-tool=cargo --timeout=500 --build-timeout=500
       - name: Upload mutants.out
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: mutants-incremental-cargo.out
@@ -138,10 +183,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install nightly toolchain"
         uses: dtolnay/rust-toolchain@nightly
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: "Build fuzz targets"
         run: cd fuzz && cargo build
diff --git a/.github/workflows/standup-compile.yml b/.github/workflows/standup-compile.yml
index bd3f01849..992d429a6 100644
--- a/.github/workflows/standup-compile.yml
+++ b/.github/workflows/standup-compile.yml
@@ -10,8 +10,8 @@ jobs:
   compile:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install requests pyyaml
diff --git a/.github/workflows/standup-on-comment.yml b/.github/workflows/standup-on-comment.yml
index f244f8f99..4c7dcf181 100644
--- a/.github/workflows/standup-on-comment.yml
+++ b/.github/workflows/standup-on-comment.yml
@@ -14,8 +14,8 @@ jobs:
       contains(github.event.comment.body, '/check-in')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install requests pyyaml
diff --git a/.github/workflows/standup-prompt.yml b/.github/workflows/standup-prompt.yml
index 5d5056075..defac6f13 100644
--- a/.github/workflows/standup-prompt.yml
+++ b/.github/workflows/standup-prompt.yml
@@ -15,8 +15,8 @@ jobs:
   create-discussion:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install requests pyyaml
diff --git a/payjoin-cli/contrib/test.sh b/payjoin-cli/contrib/test.sh
index d59518991..5fe025593 100755
--- a/payjoin-cli/contrib/test.sh
+++ b/payjoin-cli/contrib/test.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 set -e
 
-cargo test --locked --package payjoin-cli --verbose --all-features
+cargo test --locked --package payjoin-cli --all-features
diff --git a/payjoin-ffi/contrib/test.sh b/payjoin-ffi/contrib/test.sh
index 19689fa69..5950484cd 100755
--- a/payjoin-ffi/contrib/test.sh
+++ b/payjoin-ffi/contrib/test.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -e
 cd "$(dirname "$0")/.."
-cargo test --package payjoin-ffi --verbose --features=_manual-tls,_test-utils
+cargo test --package payjoin-ffi --features=_manual-tls,_test-utils
 BINDINGS="dart javascript python csharp"
 pids=()
 tmpfiles=()
diff --git a/payjoin-mailroom/contrib/test.sh b/payjoin-mailroom/contrib/test.sh
index 8faaff83f..ae39d5f0b 100755
--- a/payjoin-mailroom/contrib/test.sh
+++ b/payjoin-mailroom/contrib/test.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 set -e
 
-cargo test --locked --package payjoin-mailroom --verbose --all-features --lib
-cargo test --locked --package payjoin-mailroom --verbose --all-features --test integration
+cargo test --locked --package payjoin-mailroom --all-features --lib
+cargo test --locked --package payjoin-mailroom --all-features --test integration
diff --git a/payjoin/contrib/test.sh b/payjoin/contrib/test.sh
index 190dcae9a..1bb7a0910 100755
--- a/payjoin/contrib/test.sh
+++ b/payjoin/contrib/test.sh
@@ -3,10 +3,10 @@ set -e
 
 features=("v1" "v2")
 
-cargo test --locked --package payjoin --verbose --all-features --lib
-cargo test --locked --package payjoin --verbose --all-features --test integration
+cargo test --locked --package payjoin --all-features --lib
+cargo test --locked --package payjoin --all-features --test integration
 
 for feature in "${features[@]}"; do
-    cargo test --locked --package payjoin --verbose --no-default-features --features "$feature" --lib --no-run
-    cargo test --locked --package payjoin --verbose --no-default-features --features "$feature" --test integration --no-run
+    cargo test --locked --package payjoin --no-default-features --features "$feature" --lib --no-run
+    cargo test --locked --package payjoin --no-default-features --features "$feature" --test integration --no-run
 done