diff --git a/.github/workflows/tag-on-main.yaml b/.github/workflows/tag-on-main.yaml
index deaf2cc..3224a81 100644
--- a/.github/workflows/tag-on-main.yaml
+++ b/.github/workflows/tag-on-main.yaml
@@ -5,6 +5,14 @@ on:
     branches:
       - main
 
+# Two merges in quick succession would otherwise run in parallel, both read the
+# same `git describe` tag, and compute the same next version - one tag push wins
+# and the other fails. Serialize instead, and never cancel: a cancelled run
+# leaves a tag whose release never happened.
+concurrency:
+  group: tag-on-main
+  cancel-in-progress: false
+
 jobs:
 
   determine-version:
@@ -81,6 +89,10 @@ jobs:
       contents: write
       packages: write
     uses: ./.github/workflows/release-golang-executable-on-tag.yaml
+    # A called workflow receives no secrets unless they are passed, so
+    # HOMEBREW_TAP_ACCESS_TOKEN arrived empty in v3.0.5 and the tap update failed
+    # while the release itself succeeded.
+    secrets: inherit
     with:
       tag: ${{ needs.determine-version.outputs.NEW_VERSION }}
       # These releases get no CHANGELOG entry, so the body carries the fixed