diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 94a4a6309..94f9c6104 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -1,9 +1,11 @@
 on:
   push:
-    branches: [ master, develop ]
+    branches: [master, develop]
 
 jobs:
   bump_version:
+    permissions:
+      actions: "write"
     name: "Bump pubspec version"
     runs-on: ubuntu-latest
     env:
@@ -29,6 +31,16 @@ jobs:
         with:
           commit_message: "Bump app version [no ci]"
 
+      - name: Cancel run if on master and does not match develop (e.g due to hotfix)
+        if: github.ref == 'refs/heads/master'
+        run: |
+          git fetch origin develop
+          if [[ $(git diff --quiet HEAD origin/develop) ]]; then
+            echo "Master version does not match develop version"
+            gh run cancel ${{ github.run_id }}
+            gh run watch ${{ github.run_id }}
+          fi
+
       - name: Propagate master version bump to develop
         if: github.ref == 'refs/heads/master'
         run: git push --force-with-lease origin HEAD:develop
@@ -49,7 +61,7 @@ jobs:
       - uses: actions/setup-java@v3
         with:
           java-version: ${{env.JAVA_VERSION}}
-          distribution: 'zulu'
+          distribution: "zulu"
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}