diff --git a/.github/workflows/release-mac-build.yml b/.github/workflows/release-mac-build.yml
index 10bdeb26c7b..e9dc02b12a1 100644
--- a/.github/workflows/release-mac-build.yml
+++ b/.github/workflows/release-mac-build.yml
@@ -30,7 +30,8 @@ permissions:
   contents: write
 
 concurrency:
-  group: release-mac-build-${{ inputs.tag }}
+  # Why: a qualification run that reuses a live tag must never queue behind or replace its release build.
+  group: release-mac-build-${{ inputs.tag }}${{ inputs.qualification_only && '-qualification' || '' }}
   cancel-in-progress: false
 
 jobs:
diff --git a/config/scripts/mac-notarization-builder-contract.test.mjs b/config/scripts/mac-notarization-builder-contract.test.mjs
index 054da7bdd43..b16d0a58d0e 100644
--- a/config/scripts/mac-notarization-builder-contract.test.mjs
+++ b/config/scripts/mac-notarization-builder-contract.test.mjs
@@ -95,6 +95,11 @@ describe('macOS build workflow policy', () => {
   it('qualification signs the workflow commit, gates its complete template, and cannot publish', () => {
     const source = workflow('release')
     expect(source.on.workflow_dispatch.inputs.qualification_only.default).toBe(false)
+    expect(source.concurrency).toEqual({
+      group:
+        "release-mac-build-${{ inputs.tag }}${{ inputs.qualification_only && '-qualification' || '' }}",
+      'cancel-in-progress': false
+    })
     expect(source.jobs['qualification-template'].if).toBe('inputs.qualification_only')
     expect(source.jobs['qualification-template'].with).toEqual({
       ref: '${{ github.sha }}',