diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec57ede..d5d3123 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,9 +5,13 @@ on:
     branches: [ main ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v6
diff --git a/.github/workflows/dependabot_auto_merge.yml b/.github/workflows/dependabot_auto_merge.yml
index 748f523..91d74ae 100644
--- a/.github/workflows/dependabot_auto_merge.yml
+++ b/.github/workflows/dependabot_auto_merge.yml
@@ -9,6 +9,7 @@ jobs:
   auto-merge:
     if: github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'dependabot/')
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a45fc15..cd95d79 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -17,9 +17,14 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   refresh-token:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout Code
         uses: actions/checkout@v6
diff --git a/.node-version b/.node-version
new file mode 100644
index 0000000..209e3ef
--- /dev/null
+++ b/.node-version
@@ -0,0 +1 @@
+20
diff --git a/package-lock.json b/package-lock.json
index 32bb907..f1b1f65 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7,6 +7,9 @@
     "": {
       "name": "schwab-token-refresher",
       "version": "1.0.0",
+      "engines": {
+        "node": "20.x"
+      },
       "dependencies": {
         "@google-cloud/secret-manager": "^6.1.3",
         "axios": "^1.17.0",
diff --git a/package.json b/package.json
index eb47226..14ab527 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,9 @@
   "name": "schwab-token-refresher",
   "version": "1.0.0",
   "main": "main.js",
+  "engines": {
+    "node": "20.x"
+  },
   "scripts": {
     "start": "xvfb-run --auto-servernum --server-args='-screen 0 1280x800x24' node main.js"
   },