diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index fc91907edbc2d..63bd93403dce2 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -1,27 +1,6 @@
 name: Integration tests
 
-on:
-  pull_request:
-    paths:
-      - .github/workflows/integration.yml
-      - .proxy-version
-      - '**/*.go'
-      - '**/Dockerfile*'
-      - Cargo.lock
-      # Don't run integration tests if only the Chart metadata has changed.
-      - '!**/Chart.yaml'
-      - '!**/README*'
-      - charts/**
-      - go.sum
-      - justfile
-      - multicluser/**
-      - policy-controller/**
-      - policy-test/**
-      - viz/**
-      - '!.devcontainer/**'
-      - rust-toolchain.toml
-      - bin/rust-toolchain-version
-      - bin/_docker.sh
+on: pull_request
 
 permissions:
   contents: read
@@ -37,29 +16,103 @@ env:
   YQ_VERSION: v4.25.1
   LINKERD2_PROXY_REPO: ${{ vars.LINKERD2_PROXY_REPO }}
 
+concurrency:
+  group:  ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
 jobs:
-  cleanup:
+  meta:
     runs-on: ubuntu-20.04
-    permissions:
-      actions: write
     steps:
-      - uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+      - id: tag
+        run: echo "tag=$(CI_FORCE_CLEAN=1 bin/root-tag)" >> "$GITHUB_OUTPUT"
+      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
+        id: core
+        with:
+          files: |
+            .github/workflows/integration.yml
+            .proxy-version
+            go.sum
+            **/*.go
+            **/Dockerfile*
+            charts/**
+            justfile
+          files_ignore: |
+            .devcontainer/**
+            **/Chart.yaml
+            **/README*
+      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
+        id: policy
+        with:
+          files: |
+            .github/workflows/integration.yml
+            .proxy-version
+            Cargo.lock
+            charts/linkerd-control-plane/**
+            charts/linkerd-crds/templates/policy/**
+            justfile
+            policy-controller/**
+            policy-test/**
+            rust-toolchain.toml
+          files_ignore: |
+            **/Chart.yaml
+            **/README*
+      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
+        id: multicluster
+        with:
+          files: |
+            .github/workflows/integration.yml
+            .proxy-version
+            justfile
+            multicluster/**
+            test/integration/multicluster/**
+          files_ignore: |
+            **/Chart.yaml
+            **/README*
+      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
+        id: viz
         with:
-          all_but_latest: true
-          access_token: ${{ github.token }}
+          files: |
+            .github/workflows/integration.yml
+            .proxy-version
+            justfile
+            viz/**
+            test/integration/viz/**
+          files_ignore: |
+            **/Chart.yaml
+            **/README*
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+      changed-core: ${{ steps.core.outputs.any_changed }}
+      changed-policy: ${{ steps.policy.outputs.any_changed }}
+      changed-multicluster: ${{ steps.multicluster.outputs.any_changed }}
+      changed-viz: ${{ steps.viz.outputs.any_changed }}
+      changed: >-
+        ${{
+          steps.core.outputs.any_changed == 'true' ||
+          steps.policy.outputs.any_changed == 'true' ||
+          steps.multicluster.outputs.any_changed == 'true' ||
+          steps.viz.outputs.any_changed == 'true'
+        }}
 
-  tag:
-    needs: [cleanup]
+  info:
+    needs: meta
     runs-on: ubuntu-20.04
+    timeout-minutes: 2
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - run: echo "tag=$(CI_FORCE_CLEAN=1 bin/root-tag)" >> "$GITHUB_OUTPUT"
-        id: tag
-    outputs:
-      tag: ${{ steps.tag.outputs.tag }}
+      - name: Info
+        run: |
+          echo "tag=${{ needs.meta.outputs.tag }}"
+          echo "changed=${{ needs.meta.outputs.changed }}"
+          echo "changed-core=${{ needs.meta.outputs.changed-core }}"
+          echo "changed-policy=${{ needs.meta.outputs.changed-policy }}"
+          echo "changed-multicluster=${{ needs.meta.outputs.changed-multicluster }}"
+          echo "changed-viz=${{ needs.meta.outputs.changed-viz }}"
 
   build-cli:
-    needs: [tag]
+    needs: meta
+    if: needs.meta.outputs.changed == 'true'
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
@@ -70,14 +123,14 @@ jobs:
           docker-registry: ${{ env.DOCKER_REGISTRY }}
           docker-target: linux-amd64
           component: cli-bin
-          tag: ${{ needs.tag.outputs.tag }}
+          tag: ${{ needs.meta.outputs.tag }}
       - name: Extract CLI binary
         run: |
           mkdir -p /home/runner/archives
           id=$(docker create '${{ steps.build.outputs.image }}')
           docker cp "$id:/out/linkerd-linux-amd64" /home/runner/archives/linkerd
           v=$(/home/runner/archives/linkerd version --short --client)
-          [[ "$v" == '${{ needs.tag.outputs.tag }}' ]] || exit 1
+          [[ "$v" == '${{ needs.meta.outputs.tag }}' ]] || exit 1
       - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
         with:
           name: image-archives-cli
@@ -90,7 +143,8 @@ jobs:
   ##
 
   build-core:
-    needs: [tag]
+    needs: meta
+    if: needs.meta.outputs.changed == 'true'
     runs-on: ubuntu-20.04
     strategy:
       matrix:
@@ -107,7 +161,7 @@ jobs:
           docker-registry: ${{ env.DOCKER_REGISTRY }}
           docker-target: linux-amd64
           component: ${{ matrix.component }}
-          tag: ${{ needs.tag.outputs.tag }}
+          tag: ${{ needs.meta.outputs.tag }}
         env:
           LINKERD2_PROXY_GITHUB_TOKEN: ${{ secrets.LINKERD2_PROXY_GITHUB_TOKEN }}
       - name: Run docker save
@@ -120,7 +174,8 @@ jobs:
           path: /home/runner/archives
 
   test-core:
-    needs: [tag, build-cli, build-core]
+    needs: [meta, build-cli, build-core]
+    if: needs.meta.outputs.changed == 'true'
     strategy:
       matrix:
         test:
@@ -129,10 +184,10 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
         with:
           go-version: '1.22'
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
         with:
           pattern: image-archives-*
@@ -143,36 +198,15 @@ jobs:
       - run: bin/tests --images archive --cleanup-docker --name ${{ matrix.test }} "$HOME/linkerd"
         env:
           LINKERD_DOCKER_REGISTRY: ${{ env.DOCKER_REGISTRY }}
-          TAG: ${{ needs.tag.outputs.tag }}
+          TAG: ${{ needs.meta.outputs.tag }}
 
   ##
   ## Policy: Only run policy tests when the policy controller or proxy changes
   ##
 
-  changed-policy:
-    needs: [cleanup]
-    runs-on: ubuntu-20.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
-        id: changed
-        with:
-          files: |
-            .github/workflows/integration.yml
-            .proxy-version
-            Cargo.lock
-            charts/linkerd-control-plane/**
-            charts/linkerd-crds/templates/policy/**
-            justfile
-            policy-controller/**
-            policy-test/**
-    outputs:
-      modified: ${{ steps.changed.outputs.any_modified }}
-
   test-policy:
-    needs: [tag, changed-policy, build-cli, build-core]
-    if: needs.changed-policy.outputs.modified == 'true'
+    needs: [meta, build-cli, build-core]
+    if: needs.meta.outputs.changed-policy == 'true'
     runs-on: ubuntu-20.04
     timeout-minutes: 20
     strategy:
@@ -188,7 +222,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
         with:
-          patter: image-archives-*
+          pattern: image-archives-*
           path: image-archives
           merge-multiple: true
       - run: find image-archives -ls
@@ -209,12 +243,12 @@ jobs:
       - run: docker load <image-archives/policy-controller.tar
       - run: docker load <image-archives/proxy.tar
       - run: docker image ls
-      - run: just linkerd-tag='${{ needs.tag.outputs.tag }}' linkerd-exec="$HOME/linkerd" linkerd-install
+      - run: just linkerd-tag='${{ needs.meta.outputs.tag }}' linkerd-exec="$HOME/linkerd" linkerd-install
       - name: Load images
         run: |
           # Image loading is flakey in CI, so retry!
           for _ in {1..6} ; do
-            if just linkerd-tag='${{ needs.tag.outputs.tag }}' policy-test-deps-load ; then exit 0 ; fi
+            if just linkerd-tag='${{ needs.meta.outputs.tag }}' policy-test-deps-load ; then exit 0 ; fi
             sleep 10
             echo retrying...
           done
@@ -226,7 +260,8 @@ jobs:
   ##
 
   build-ext:
-    needs: [tag]
+    needs: meta
+    if: needs.meta.outputs.changed == 'true'
     runs-on: ubuntu-20.04
     strategy:
       matrix:
@@ -244,7 +279,7 @@ jobs:
           docker-registry: ${{ env.DOCKER_REGISTRY }}
           docker-target: linux-amd64
           component: ${{ matrix.component }}
-          tag: ${{ needs.tag.outputs.tag }}
+          tag: ${{ needs.meta.outputs.tag }}
       - name: Run docker save
         run: |
           mkdir -p /home/runner/archives
@@ -256,7 +291,8 @@ jobs:
 
   # These tests exercise core functionality, but need the viz extension.
   test-ext:
-    needs: [tag, build-cli, build-core, build-ext]
+    needs: [meta, build-cli, build-core, build-ext]
+    if: needs.meta.outputs.changed == 'true'
     strategy:
       matrix:
         integration_test:
@@ -271,10 +307,10 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
         with:
           go-version: '1.22'
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
         with:
           pattern: image-archives-*
@@ -290,34 +326,16 @@ jobs:
   ## Viz: Run the (flakey) `viz` suite only when the `viz` extension is updated.
   ##
 
-  changed-viz:
-    needs: [cleanup]
-    runs-on: ubuntu-20.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
-        id: changed
-        with:
-          files: |
-            .github/workflows/integration.yml
-            .proxy-version
-            justfile
-            viz/**
-            test/integration/viz/**
-    outputs:
-      modified: ${{ steps.changed.outputs.any_modified }}
-
   test-viz:
-    needs: [tag, changed-viz, build-cli, build-core, build-ext]
-    if: needs.changed-viz.outputs.modified == 'true'
+    needs: [meta, build-cli, build-core, build-ext]
+    if: needs.meta.outputs.changed-viz == 'true'
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
         with:
           go-version: '1.22'
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
         with:
           pattern: image-archives-*
@@ -334,27 +352,9 @@ jobs:
   ##               Tests are run on min and max k8s versions
   ##
 
-  changed-multicluster:
-    needs: [cleanup]
-    runs-on: ubuntu-20.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
-        id: changed
-        with:
-          files: |
-            .github/workflows/integration.yml
-            .proxy-version
-            justfile
-            multicluster/**
-            test/integration/multicluster/**
-    outputs:
-      modified: ${{ steps.changed.outputs.any_modified }}
-
   test-multicluster:
-    needs: [tag, changed-multicluster, build-cli, build-core, build-ext]
-    if: needs.changed-multicluster.outputs.modified == 'true'
+    needs: [meta, build-cli, build-core, build-ext]
+    if: needs.meta.outputs.changed-multicluster == 'true'
     runs-on: ubuntu-20.04
     timeout-minutes: 20
     strategy:
@@ -366,10 +366,10 @@ jobs:
       - uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
         with:
           go-version: '1.22'
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
         with:
           pattern: image-archives-*
@@ -391,11 +391,29 @@ jobs:
       - run: just mc-test-build
       - name: Run just mc-test-load
         run: |
-          just linkerd-tag='${{ needs.tag.outputs.tag }}' \
+          just linkerd-tag='${{ needs.meta.outputs.tag }}' \
               k3d-k8s='${{ matrix.k8s }}' \
               mc-test-load
       - name: Run just mc-test-run
         run: |
-          just linkerd-tag='${{ needs.tag.outputs.tag }}' \
+          just linkerd-tag='${{ needs.meta.outputs.tag }}' \
               k3d-k8s='${{ matrix.k8s }}' \
               mc-test-run
+
+  integrations-ok:
+    needs: [test-core, test-policy, test-ext, test-viz, test-multicluster]
+    if: always()
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Results
+        run: |
+          echo 'needs.test-core.result: ${{ needs.test-core.result }}'
+          echo 'needs.test-policy.result: ${{ needs.test-policy.result }}'
+          echo 'needs.test-ext.result: ${{ needs.test-ext.result }}'
+          echo 'needs.test-viz.result: ${{ needs.test-viz.result }}'
+          echo 'needs.test-multicluster.result: ${{ needs.test-multicluster.result }}'
+
+      - name: Verify jobs
+        # All jobs must succeed or be skipped.
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1