diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 1c3553d96b5..bbcbadef4e1 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -14,5 +14,6 @@ jobs:
       - name: 'Dependency review'
         uses: actions/dependency-review-action@v4
         with:
+          fail-on-severity: high
           retry-on-snapshot-warnings: true
           retry-on-snapshot-warnings-timeout: 600
diff --git a/checker/bin-devel/test-cftests-junit-jdk21.sh b/checker/bin-devel/test-cftests-junit-jdk21.sh
index fe20e2caf60..c3785231301 100755
--- a/checker/bin-devel/test-cftests-junit-jdk21.sh
+++ b/checker/bin-devel/test-cftests-junit-jdk21.sh
@@ -11,5 +11,6 @@ SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 export ORG_GRADLE_PROJECT_useJdkCompiler=21
 source "$SCRIPTDIR"/clone-related.sh
 
-
-./gradlew test -x javadoc -x allJavadoc --console=plain --warning-mode=all
+# Adding --max-workers=1 to avoid random failures in Github Actions. An alternative solution is to use --no-build-cache.
+# https://github.com/eisop/checker-framework/issues/849
+./gradlew test -x javadoc -x allJavadoc --console=plain --warning-mode=all --max-workers=1
diff --git a/checker/bin-devel/test-cftests-junit.sh b/checker/bin-devel/test-cftests-junit.sh
index 92d31565b88..eaf78761af0 100755
--- a/checker/bin-devel/test-cftests-junit.sh
+++ b/checker/bin-devel/test-cftests-junit.sh
@@ -10,5 +10,6 @@ SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090# In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
 source "$SCRIPTDIR"/clone-related.sh
 
-
-./gradlew test -x javadoc -x allJavadoc --console=plain --warning-mode=all
+# Adding --max-workers=1 to avoid random failures in Github Actions. An alternative solution is to use --no-build-cache.
+# https://github.com/eisop/checker-framework/issues/849
+./gradlew test -x javadoc -x allJavadoc --console=plain --warning-mode=all --max-workers=1
diff --git a/checker/bin-devel/test-cftests-nonjunit.sh b/checker/bin-devel/test-cftests-nonjunit.sh
index 1165c83c415..55667f55a0c 100755
--- a/checker/bin-devel/test-cftests-nonjunit.sh
+++ b/checker/bin-devel/test-cftests-nonjunit.sh
@@ -10,8 +10,9 @@ SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090# In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
 source "$SCRIPTDIR"/clone-related.sh
 
-
-./gradlew nonJunitTests -x javadoc -x allJavadoc --console=plain --warning-mode=all
+# Adding --max-workers=1 to avoid random failures in Github Actions. An alternative solution is to use --no-build-cache.
+# https://github.com/eisop/checker-framework/issues/849
+./gradlew nonJunitTests -x javadoc -x allJavadoc --console=plain --warning-mode=all --max-workers=1
 ./gradlew publishToMavenLocal -x javadoc -x allJavadoc --console=plain --warning-mode=all
 # Moved example-tests out of all tests because it fails in
 # the release script because the newest maven artifacts are not published yet.