diff --git a/.github/actions/run-in-ci-image/action.yml b/.github/actions/run-in-ci-image/action.yml
index 8d994ed6..3fafe38c 100644
--- a/.github/actions/run-in-ci-image/action.yml
+++ b/.github/actions/run-in-ci-image/action.yml
@@ -51,4 +51,4 @@ runs:
           --workdir "$PWD" \
           "${env_args[@]}" \
           "$INPUT_IMAGE" \
-          bash -o pipefail -c "$INPUT_RUN"
+          bash -e -o pipefail -c "$INPUT_RUN"
diff --git a/.github/workflows/ci-image.yml b/.github/workflows/ci-image.yml
index c61908a8..c93782de 100644
--- a/.github/workflows/ci-image.yml
+++ b/.github/workflows/ci-image.yml
@@ -1,5 +1,9 @@
 name: CI image
 
+concurrency:
+  group: ci-image-${{ github.sha }}
+  cancel-in-progress: false
+
 # Resolves the CI image the calling workflow's jobs run in, building and pushing
 # it only when it isn't published yet.
 on: