After a production incident is resolved, what would you do to make it less likely to happen again?

In production I track incident actions to completion and verify that each one would have changed detection, impact, mitigation, or recovery. Alerts are fired in a controlled test, runbooks are rehearsed, migration and release guards become automated pipeline checks, and architectural changes receive measurable success criteria. Actions are prioritized by risk reduction rather than by how easy they are to close, with an owner and review date. I also look for the same failure class in sibling services so learning is not trapped in one team. A later game day or real event confirms whether the system now fails more safely and whether responders can recover without rediscovering the incident.