diff --git a/.github/workflows/extra-builds.yml b/.github/workflows/extra-builds.yml
index 458eb76a6..11fd42a6c 100644
--- a/.github/workflows/extra-builds.yml
+++ b/.github/workflows/extra-builds.yml
@@ -1,6 +1,14 @@
 name: Test extra build flows
 
-on: [push, pull_request]
+on:
+  # always test main
+  push:
+    branches:
+      - main
+  # test PRs
+  pull_request:
+  # allow triggering tests, ignores skip check
+  workflow_dispatch:
 
 jobs:
   pre_job:
@@ -11,11 +19,11 @@ jobs:
       - id: skip_check
         uses: fkirc/skip-duplicate-actions@v5
         with:
+          # don't run on documentation changes
           paths_ignore: '["**/README.md", "docs/**", "guidelines/**"]'
           # cancel previous builds if a new commit is pushed
-          cancel_others: 'true'
-          # only run on push *or* pull_request, not both
-          concurrent_skipping: 'same_content_newer'
+          # but never cancel main
+          cancel_others: ${{ github.ref != 'refs/heads/main' }}
 
   vs-prep:
     name: Prepare Visual Studio build
diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index f9574594a..f44dee1ba 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -1,6 +1,14 @@
 name: Build and run tests
 
-on: [push, pull_request]
+on:
+  # always test main
+  push:
+    branches:
+      - main
+  # test PRs
+  pull_request:
+  # allow triggering tests, ignores skip check
+  workflow_dispatch:
 
 jobs:
   pre_job:
@@ -11,11 +19,12 @@ jobs:
       - id: skip_check
         uses: fkirc/skip-duplicate-actions@v5
         with:
+          # don't run on documentation changes
           paths_ignore: '["**/README.md", "docs/**", "guidelines/**"]'
           # cancel previous builds if a new commit is pushed
-          cancel_others: 'true'
-          # only run on push *or* pull_request, not both
-          concurrent_skipping: 'same_content_newer'
+          # but never cancel main
+          cancel_others: ${{ github.ref != 'refs/heads/main' }}
+
   pre_docs_job:
     runs-on: ubuntu-latest
     outputs:
@@ -24,15 +33,16 @@ jobs:
       - id: skip_check
         uses: fkirc/skip-duplicate-actions@v5
         with:
+          # don't run on readme changes
           paths_ignore: '["**/README.md"]'
           # cancel previous builds if a new commit is pushed
-          cancel_others: 'true'
-          # only run on push *or* pull_request, not both
-          concurrent_skipping: 'same_content_newer'
+          # but never cancel main
+          cancel_others: ${{ github.ref != 'refs/heads/main' }}
 
   build-yosys:
     name: Reusable build
     runs-on: ${{ matrix.os }}
+    # pre_job is a subset of pre_docs_job, so we can always build for pre_docs_job
     needs: pre_docs_job
     if: needs.pre_docs_job.outputs.should_skip != 'true'
     env:
@@ -40,7 +50,6 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
-        sanitizer: [undefined, address]
       fail-fast: false
     steps:
       - name: Checkout Yosys
@@ -58,7 +67,6 @@ jobs:
           mkdir build
           cd build
           make -f ../Makefile config-$CC
-          echo 'SANITIZER = ${{ matrix.sanitizer }}' >> Makefile.conf
           make -f ../Makefile -j$procs ENABLE_LTO=1
 
       - name: Log yosys-config output
@@ -74,7 +82,7 @@ jobs:
       - name: Store build artifact
         uses: actions/upload-artifact@v4
         with:
-          name: build-${{ matrix.os }}-${{ matrix.sanitizer }}
+          name: build-${{ matrix.os }}
           path: build.tar
           retention-days: 1
 
@@ -85,12 +93,9 @@ jobs:
     if: needs.pre_job.outputs.should_skip != 'true'
     env:
       CC: clang
-      ASAN_OPTIONS: halt_on_error=1
-      UBSAN_OPTIONS: halt_on_error=1
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
-        sanitizer: [undefined, address]
       fail-fast: false
     steps:
       - name: Checkout Yosys
@@ -139,7 +144,7 @@ jobs:
       - name: Download build artifact
         uses: actions/download-artifact@v4
         with:
-          name: build-${{ matrix.os }}-${{ matrix.sanitizer }}
+          name: build-${{ matrix.os }}
 
       - name: Uncompress build
         shell: bash
@@ -209,7 +214,6 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        sanitizer: [undefined, address]
       fail-fast: false
     steps:
       - name: Checkout Yosys
@@ -223,7 +227,7 @@ jobs:
       - name: Download build artifact
         uses: actions/download-artifact@v4
         with:
-          name: build-${{ matrix.os }}-${{ matrix.sanitizer }}
+          name: build-${{ matrix.os }}
 
       - name: Uncompress build
         shell: bash
diff --git a/.github/workflows/test-compile.yml b/.github/workflows/test-compile.yml
index 7a706e69a..f208b911a 100644
--- a/.github/workflows/test-compile.yml
+++ b/.github/workflows/test-compile.yml
@@ -1,6 +1,14 @@
 name: Compiler testing
 
-on: [push, pull_request]
+on:
+  # always test main
+  push:
+    branches:
+      - main
+  # test PRs
+  pull_request:
+  # allow triggering tests, ignores skip check
+  workflow_dispatch:
 
 jobs:
   pre_job:
@@ -11,11 +19,11 @@ jobs:
       - id: skip_check
         uses: fkirc/skip-duplicate-actions@v5
         with:
+          # don't run on documentation changes
           paths_ignore: '["**/README.md", "docs/**", "guidelines/**"]'
           # cancel previous builds if a new commit is pushed
-          cancel_others: 'true'
-          # only run on push *or* pull_request, not both
-          concurrent_skipping: 'same_content_newer'
+          # but never cancel main
+          cancel_others: ${{ github.ref != 'refs/heads/main' }}
 
   test-compile:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/test-sanitizers.yml b/.github/workflows/test-sanitizers.yml
new file mode 100644
index 000000000..fb76d1266
--- /dev/null
+++ b/.github/workflows/test-sanitizers.yml
@@ -0,0 +1,105 @@
+name: Check clang sanitizers
+
+on:
+  # always test main
+  push:
+    branches:
+      - main
+  # ignore PRs due to time needed
+  # allow triggering tests, ignores skip check
+  workflow_dispatch:
+
+jobs:
+  pre_job:
+    runs-on: ubuntu-latest
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@v5
+        with:
+          # don't run on documentation changes
+          paths_ignore: '["**/README.md", "docs/**", "guidelines/**"]'
+
+  run_san:
+    name: Build and run tests
+    runs-on: ${{ matrix.os }}
+    needs: pre_job
+    if: needs.pre_job.outputs.should_skip != 'true'
+    env:
+      CC: clang
+      ASAN_OPTIONS: halt_on_error=1
+      UBSAN_OPTIONS: halt_on_error=1
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        sanitizer: ['undefined,address']
+      fail-fast: false
+    steps:
+      - name: Checkout Yosys
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+          persist-credentials: false
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-build-env
+
+      - name: Build
+        shell: bash
+        run: |
+          mkdir build
+          cd build
+          make -f ../Makefile config-$CC
+          echo 'SANITIZER = ${{ matrix.sanitizer }}' >> Makefile.conf
+          make -f ../Makefile -j$procs ENABLE_LTO=1
+
+      - name: Log yosys-config output
+        run: |
+          ./yosys-config || true
+
+      - name: Get iverilog
+        shell: bash
+        run: |
+          git clone https://github.com/steveicarus/iverilog.git
+          cd iverilog
+          echo "IVERILOG_GIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
+
+      - name: Get vcd2fst
+        shell: bash
+        run: |
+          git clone https://github.com/mmicko/libwave.git
+          mkdir -p ${{ github.workspace }}/.local/
+          cd libwave
+          cmake . -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/.local
+          make -j$procs
+          make install
+
+      - name: Cache iverilog
+        id: cache-iverilog
+        uses: actions/cache@v4
+        with:
+          path: .local/
+          key: ${{ matrix.os }}-${IVERILOG_GIT}
+
+      - name: Build iverilog
+        if: steps.cache-iverilog.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          mkdir -p ${{ github.workspace }}/.local/
+          cd iverilog
+          autoconf
+          CC=gcc CXX=g++ ./configure --prefix=${{ github.workspace }}/.local
+          make -j$procs
+          make install
+
+      - name: Run tests
+        shell: bash
+        run: |
+          make -j$procs test TARGETS= EXTRA_TARGETS= CONFIG=$CC
+
+      - name: Report errors
+        if: ${{ failure() }}
+        shell: bash
+        run: |
+          find tests/**/*.err -print -exec cat {} \;
diff --git a/.github/workflows/test-verific.yml b/.github/workflows/test-verific.yml
index 013c9f8ca..9af07b920 100644
--- a/.github/workflows/test-verific.yml
+++ b/.github/workflows/test-verific.yml
@@ -1,6 +1,14 @@
 name: Build and run tests with Verific (Linux)
 
-on: [push, pull_request]
+on:
+  # always test main
+  push:
+    branches:
+      - main
+  # test PRs
+  pull_request:
+  # allow triggering tests, ignores skip check
+  workflow_dispatch:
 
 jobs:
   pre-job:
@@ -11,11 +19,11 @@ jobs:
       - id: skip_check
         uses: fkirc/skip-duplicate-actions@v5
         with:
+          # don't run on documentation changes
           paths_ignore: '["**/README.md", "docs/**", "guidelines/**"]'
           # cancel previous builds if a new commit is pushed
-          cancel_others: 'true'
-          # only run on push *or* pull_request, not both
-          concurrent_skipping: 'same_content_newer'
+          # but never cancel main
+          cancel_others: ${{ github.ref != 'refs/heads/main' }}
 
   test-verific:
     needs: pre-job