diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 593003192..750f2a050 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,13 +1,18 @@
 name: release
+
 on:
-  create:
-    tags:
-      - v*
   push:
+    tags:
+      - 'v*'
     branches:
       - main
 
-permissions: read-all
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 # Note the only differences between release and canary-release jobs are:
 # - only canary passes --overwrite flag
@@ -18,6 +23,7 @@ jobs:
   release:
     if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'helm/helm'
     runs-on: ubuntu-latest-16-cores
+    timeout-minutes: 45
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
@@ -25,25 +31,30 @@ jobs:
           fetch-depth: 0
 
       - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
+        run: |
+          set -euo pipefail
+          cat ".github/env" >> "$GITHUB_ENV"
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
         with:
           go-version: '${{ env.GOLANG_VERSION }}'
           check-latest: true
+
       - name: Run unit tests
-        run: make test-coverage
-      - name: Build Helm Binaries
         run: |
-          set -eu -o pipefail
+          set -euo pipefail
+          make test-coverage
 
+      - name: Build Helm Binaries
+        run: |
+          set -euo pipefail
           make build-cross VERSION="${{ github.ref_name }}"
           make dist checksum VERSION="${{ github.ref_name }}"
 
       - name: Set latest version
         run: |
-          set -eu -o pipefail
+          set -euo pipefail
 
           mkdir -p _dist_versions
 
@@ -81,14 +92,17 @@ jobs:
           connection_string: ${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}
 
   canary-release:
-    runs-on: ubuntu-latest-16-cores
     if: github.ref == 'refs/heads/main' && github.repository == 'helm/helm'
+    runs-on: ubuntu-latest-16-cores
+    timeout-minutes: 45
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
 
       - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
+        run: |
+          set -euo pipefail
+          cat ".github/env" >> "$GITHUB_ENV"
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
@@ -97,10 +111,13 @@ jobs:
           check-latest: true
 
       - name: Run unit tests
-        run: make test-coverage
+        run: |
+          set -euo pipefail
+          make test-coverage
 
       - name: Build Helm Binaries
         run: |
+          set -euo pipefail
           make build-cross
           make dist checksum VERSION="canary"