diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 52ef37b59..f36e1f771 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -1,6 +1,17 @@
 name: Dependency Review
 
-on: pull_request
+on:
+  pull_request:
+    paths:
+      - 'package.json'
+      - 'bun.lock'
+      - '**/package.json'
+      - '**/bun.lock'
+      - '.github/workflows/**'
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -8,6 +19,7 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubicloud-standard-8
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: write
@@ -16,4 +28,5 @@ jobs:
       - uses: actions/dependency-review-action@v4
         with:
           fail-on-severity: high
+          fail-on-scopes: runtime, development
           comment-summary-in-pr: on-failure