diff --git a/.github/actions/restore-python/action.yml b/.github/actions/restore-python/action.yml
index c6e9ca4153..aa8dd6d894 100644
--- a/.github/actions/restore-python/action.yml
+++ b/.github/actions/restore-python/action.yml
@@ -17,12 +17,12 @@ runs:
   steps:
     - name: Set up Python ${{ inputs.python-version }}
       id: python
-      uses: actions/setup-python@v4.6.0
+      uses: actions/setup-python@v4.7.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Restore Python virtual environment
       id: cache-venv
-      uses: actions/cache/restore@v3.3.1
+      uses: actions/cache/restore@v3.3.2
       with:
         path: venv
         # yamllint disable-line rule:line-length
diff --git a/.github/workflows/ci-docker.yml b/.github/workflows/ci-docker.yml
index dbd0d573da..b53eaf8e1a 100644
--- a/.github/workflows/ci-docker.yml
+++ b/.github/workflows/ci-docker.yml
@@ -40,15 +40,15 @@ jobs:
         arch: [amd64, armv7, aarch64]
         build_type: ["ha-addon", "docker", "lint"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.0.0
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v4.7.0
         with:
           python-version: "3.9"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3.0.0
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3.0.0
 
       - name: Set TAG
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 79ebe8782e..0786e1b9a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,10 @@ on:
     branches: [dev, beta, release]
 
   pull_request:
+    paths:
+      - "**"
+      - "!.github/workflows/*.yml"
+      - ".github/workflows/ci.yml"
   merge_group:
 
 permissions:
@@ -30,13 +34,13 @@ jobs:
       cache-key: ${{ steps.cache-key.outputs.key }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Generate cache-key
         id: cache-key
         run: echo key="${{ hashFiles('requirements.txt', 'requirements_optional.txt', 'requirements_test.txt') }}" >> $GITHUB_OUTPUT
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
         id: python
-        uses: actions/setup-python@v4.6.0
+        uses: actions/setup-python@v4.7.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
       - name: Restore Python virtual environment
@@ -55,15 +59,6 @@ jobs:
           pip install -r requirements.txt -r requirements_optional.txt -r requirements_test.txt
           pip install -e .
 
-  yamllint:
-    name: yamllint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@v4
-      - name: Run yamllint
-        uses: frenck/action-yamllint@v1.4.1
-
   black:
     name: Check black
     runs-on: ubuntu-latest
@@ -71,7 +66,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -92,7 +87,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -113,7 +108,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -134,7 +129,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -155,7 +150,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -176,7 +171,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -196,7 +191,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -227,7 +222,6 @@ jobs:
       - pylint
       - pytest
       - pyupgrade
-      - yamllint
     strategy:
       fail-fast: false
       max-parallel: 2
@@ -235,7 +229,7 @@ jobs:
         file: [1, 2, 3, 3.1, 4, 5, 6, 7, 8, 10]
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -258,7 +252,6 @@ jobs:
       - pylint
       - pytest
       - pyupgrade
-      - yamllint
     strategy:
       fail-fast: false
       max-parallel: 2
@@ -291,7 +284,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -337,7 +330,6 @@ jobs:
       - pylint
       - pytest
       - pyupgrade
-      - yamllint
       - compile-tests
       - clang-tidy
     if: always()
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index e762512ff6..b455e3f4ea 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -18,7 +18,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v4
+      - uses: dessant/lock-threads@v4.0.1
         with:
           pr-inactive-days: "1"
           pr-lock-reason: ""
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 71a0cd2c78..99d1594f03 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.0.0
       - name: Get tag
         id: tag
         # yamllint disable rule:line-length
@@ -43,9 +43,9 @@ jobs:
     if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.0.0
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v4.7.0
         with:
           python-version: "3.x"
       - name: Set up python environment
@@ -88,24 +88,24 @@ jobs:
             target: "lint"
             baseimg: "docker"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.0.0
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v4.7.0
         with:
           python-version: "3.9"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3.0.0
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3.0.0
 
       - name: Log in to docker hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3.0.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -119,7 +119,7 @@ jobs:
             --suffix "${{ matrix.image.suffix }}"
 
       - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5.0.0
         with:
           context: .
           file: ./docker/Dockerfile
@@ -141,7 +141,7 @@ jobs:
     needs: [deploy-docker]
     steps:
       - name: Trigger Workflow
-        uses: actions/github-script@v6
+        uses: actions/github-script@v6.4.1
         with:
           github-token: ${{ secrets.DEPLOY_HA_ADDON_REPO_TOKEN }}
           script: |
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 3a3e390eef..a2d3f2f77d 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -18,7 +18,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v8.0.0
         with:
           days-before-pr-stale: 90
           days-before-pr-close: 7
@@ -38,7 +38,7 @@ jobs:
   close-issues:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v8.0.0
         with:
           days-before-pr-stale: -1
           days-before-pr-close: -1
diff --git a/.github/workflows/sync-device-classes.yml b/.github/workflows/sync-device-classes.yml
index 1759db962c..943e93a0b7 100644
--- a/.github/workflows/sync-device-classes.yml
+++ b/.github/workflows/sync-device-classes.yml
@@ -4,8 +4,7 @@ name: Synchronise Device Classes from Home Assistant
 on:
   workflow_dispatch:
   schedule:
-    - cron: '45 6 * * *'
-
+    - cron: "45 6 * * *"
 
 jobs:
   sync:
@@ -14,16 +13,16 @@ jobs:
     if: github.repository == 'esphome/esphome'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.0.0
         with:
           repository: home-assistant/core
           path: lib/home-assistant
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v4.7.0
         with:
           python-version: 3.11
 
@@ -37,7 +36,7 @@ jobs:
           python ./script/sync-device_class.py
 
       - name: Commit changes
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@v5.0.2
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
           committer: esphomebot <esphome@nabucasa.com>
diff --git a/.github/workflows/yaml-lint.yml b/.github/workflows/yaml-lint.yml
new file mode 100644
index 0000000000..77b3c1dcb5
--- /dev/null
+++ b/.github/workflows/yaml-lint.yml
@@ -0,0 +1,22 @@
+name: YAML lint
+
+on:
+  push:
+    branches: [dev, beta, release]
+    paths:
+      - "**.yaml"
+      - "**.yml"
+  pull_request:
+    paths:
+      - "**.yaml"
+      - "**.yml"
+
+jobs:
+  yamllint:
+    name: yamllint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@v4.0.0
+      - name: Run yamllint
+        uses: frenck/action-yamllint@v1.4.1