diff --git a/.github/workflows/build_firmware.yml b/.github/workflows/build_firmware.yml
index 47eacde2..edda9bc5 100644
--- a/.github/workflows/build_firmware.yml
+++ b/.github/workflows/build_firmware.yml
@@ -15,10 +15,7 @@ on:
 jobs:
   build_fw_builder:
     name: Build fw-builder Docker image
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: read
+    runs-on: ubuntu-latest # Inherits permissions from caller
     outputs:
       image_ref: ${{ steps.published-image.outputs.image_ref || steps.local-image.outputs.image_ref }}
     steps:
diff --git a/.github/workflows/on_pr_comment.yml b/.github/workflows/on_pr_comment.yml
index 26c5a0bd..96aa1e81 100644
--- a/.github/workflows/on_pr_comment.yml
+++ b/.github/workflows/on_pr_comment.yml
@@ -38,6 +38,17 @@ jobs:
               return;
             }
 
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pullNumber,
+            });
+
+            if (pull.head.sha !== run.head_sha) {
+              core.notice(`Skipping superseded workflow run ${run.id}`);
+              return;
+            }
+
             const marker = '<!-- chameleon-ultra-pr-build-artifacts -->';
             const lines = [marker, `# Build result for commit ${run.head_sha}`, ''];