diff --git a/.github/actions/build-image/action.yaml b/.github/actions/build-image/action.yaml
index a895226030..52d72544d3 100644
--- a/.github/actions/build-image/action.yaml
+++ b/.github/actions/build-image/action.yaml
@@ -47,7 +47,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -73,7 +73,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
diff --git a/.github/workflows/auto-label-pr.yml b/.github/workflows/auto-label-pr.yml
index 3b5e9f0d15..27ddfe5911 100644
--- a/.github/workflows/auto-label-pr.yml
+++ b/.github/workflows/auto-label-pr.yml
@@ -33,7 +33,7 @@ jobs:
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
 
       - name: Auto Label PR
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
diff --git a/.github/workflows/ci-api-proto.yml b/.github/workflows/ci-api-proto.yml
index 6d200956e9..e5143911d9 100644
--- a/.github/workflows/ci-api-proto.yml
+++ b/.github/workflows/ci-api-proto.yml
@@ -47,7 +47,7 @@ jobs:
           fi
       - if: failure()
         name: Review PR
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -62,7 +62,7 @@ jobs:
         run: git diff
       - if: failure()
         name: Archive artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: generated-proto-files
           path: |
@@ -70,7 +70,7 @@ jobs:
             esphome/components/api/api_pb2_service.*
       - if: success()
         name: Dismiss review
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({
diff --git a/.github/workflows/ci-clang-tidy-hash.yml b/.github/workflows/ci-clang-tidy-hash.yml
index 7905739b15..40cdff0cba 100644
--- a/.github/workflows/ci-clang-tidy-hash.yml
+++ b/.github/workflows/ci-clang-tidy-hash.yml
@@ -42,7 +42,7 @@ jobs:
 
       - if: failure() && github.event.pull_request.head.repo.full_name == github.repository
         name: Request changes
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -55,7 +55,7 @@ jobs:
 
       - if: success() && github.event.pull_request.head.repo.full_name == github.repository
         name: Dismiss review
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cf9fa8e7c0..2240879bd2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -904,7 +904,7 @@ jobs:
           fi
 
       - name: Upload memory analysis JSON
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: memory-analysis-target
           path: memory-analysis-target.json
@@ -969,7 +969,7 @@ jobs:
             --platform "$platform"
 
       - name: Upload memory analysis JSON
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: memory-analysis-pr
           path: memory-analysis-pr.json
diff --git a/.github/workflows/codeowner-approved-label-update.yml b/.github/workflows/codeowner-approved-label-update.yml
index 34ff934b77..49653b6fb3 100644
--- a/.github/workflows/codeowner-approved-label-update.yml
+++ b/.github/workflows/codeowner-approved-label-update.yml
@@ -34,7 +34,7 @@ jobs:
             CODEOWNERS
 
       - name: Check codeowner approval and update label
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
diff --git a/.github/workflows/codeowner-review-request.yml b/.github/workflows/codeowner-review-request.yml
index a89c03ba04..76be6ecd7b 100644
--- a/.github/workflows/codeowner-review-request.yml
+++ b/.github/workflows/codeowner-review-request.yml
@@ -33,7 +33,7 @@ jobs:
           ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Request reviews from component codeowners
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
diff --git a/.github/workflows/external-component-bot.yml b/.github/workflows/external-component-bot.yml
index 4fa020f63d..3165b17078 100644
--- a/.github/workflows/external-component-bot.yml
+++ b/.github/workflows/external-component-bot.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add external component comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/issue-codeowner-notify.yml b/.github/workflows/issue-codeowner-notify.yml
index 6faf956c87..b211c13985 100644
--- a/.github/workflows/issue-codeowner-notify.yml
+++ b/.github/workflows/issue-codeowner-notify.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify codeowners for component issues
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const owner = context.repo.owner;
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 0021654def..8700996271 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const {
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e8a040888..c92581b49b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -138,7 +138,7 @@ jobs:
       #     version: ${{ needs.init.outputs.tag }}
 
       - name: Upload digests
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-${{ matrix.platform.arch }}
           path: /tmp/digests
@@ -229,7 +229,7 @@ jobs:
           repositories: home-assistant-addon
 
       - name: Trigger Workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
@@ -264,7 +264,7 @@ jobs:
           repositories: esphome-schema
 
       - name: Trigger Workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
@@ -295,7 +295,7 @@ jobs:
           repositories: version-notifier
 
       - name: Trigger Workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
diff --git a/.github/workflows/status-check-labels.yml b/.github/workflows/status-check-labels.yml
index 6483bbe789..709342e5ae 100644
--- a/.github/workflows/status-check-labels.yml
+++ b/.github/workflows/status-check-labels.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for blocking labels
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const blockingLabels = ['needs-docs', 'merge-after-release', 'chained-pr'];
diff --git a/.github/workflows/sync-device-classes.yml b/.github/workflows/sync-device-classes.yml
index a71e5ef4ca..be1457387d 100644
--- a/.github/workflows/sync-device-classes.yml
+++ b/.github/workflows/sync-device-classes.yml
@@ -41,7 +41,7 @@ jobs:
           python script/run-in-env.py pre-commit run --all-files
 
       - name: Commit changes
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
           committer: esphomebot <esphome@openhomefoundation.org>
diff --git a/esphome/components/cc1101/cc1101.cpp b/esphome/components/cc1101/cc1101.cpp
index f2b7451721..c231f314cc 100644
--- a/esphome/components/cc1101/cc1101.cpp
+++ b/esphome/components/cc1101/cc1101.cpp
@@ -102,6 +102,8 @@ CC1101Component::CC1101Component() {
   memset(this->pa_table_, 0, sizeof(this->pa_table_));
 }
 
+void IRAM_ATTR CC1101Component::gpio_intr(CC1101Component *arg) { arg->enable_loop_soon_any_context(); }
+
 void CC1101Component::setup() {
   this->spi_setup();
   this->cs_->digital_write(true);
@@ -148,11 +150,12 @@ void CC1101Component::setup() {
   // Defer pin mode setup until after all components have completed setup()
   // This handles the case where remote_transmitter runs after CC1101 and changes pin mode
   if (this->gdo0_pin_ != nullptr) {
-    this->defer([this]() { this->gdo0_pin_->pin_mode(gpio::FLAG_INPUT); });
-  }
-
-  if (this->state_.PKT_FORMAT != static_cast<uint8_t>(PacketFormat::PACKET_FORMAT_FIFO)) {
-    this->disable_loop();
+    this->defer([this]() {
+      this->gdo0_pin_->pin_mode(gpio::FLAG_INPUT);
+      if (this->state_.PKT_FORMAT == static_cast<uint8_t>(PacketFormat::PACKET_FORMAT_FIFO)) {
+        this->gdo0_pin_->attach_interrupt(&CC1101Component::gpio_intr, this, gpio::INTERRUPT_RISING_EDGE);
+      }
+    });
   }
 }
 
@@ -164,6 +167,7 @@ void CC1101Component::call_listeners_(const std::vector<uint8_t> &packet, float
 }
 
 void CC1101Component::loop() {
+  this->disable_loop();
   if (this->state_.PKT_FORMAT != static_cast<uint8_t>(PacketFormat::PACKET_FORMAT_FIFO) || this->gdo0_pin_ == nullptr ||
       !this->gdo0_pin_->digital_read()) {
     return;
@@ -244,6 +248,7 @@ void CC1101Component::begin_tx() {
   this->write_(Register::PKTCTRL0, 0x32);
   ESP_LOGV(TAG, "Beginning TX sequence");
   if (this->gdo0_pin_ != nullptr) {
+    this->gdo0_pin_->detach_interrupt();
     this->gdo0_pin_->pin_mode(gpio::FLAG_OUTPUT);
   }
   // Transition through IDLE to bypass CCA (Clear Channel Assessment) which can
@@ -673,10 +678,12 @@ void CC1101Component::set_packet_mode(bool value) {
     this->state_.GDO0_CFG = 0x0D;
   }
   if (this->initialized_) {
-    if (value) {
-      this->enable_loop();
-    } else {
-      this->disable_loop();
+    if (this->gdo0_pin_ != nullptr) {
+      if (value) {
+        this->gdo0_pin_->attach_interrupt(&CC1101Component::gpio_intr, this, gpio::INTERRUPT_RISING_EDGE);
+      } else {
+        this->gdo0_pin_->detach_interrupt();
+      }
     }
     this->write_(Register::PKTCTRL0);
     this->write_(Register::PKTCTRL1);
diff --git a/esphome/components/cc1101/cc1101.h b/esphome/components/cc1101/cc1101.h
index 2efd9e082d..68d81ac8f3 100644
--- a/esphome/components/cc1101/cc1101.h
+++ b/esphome/components/cc1101/cc1101.h
@@ -93,6 +93,7 @@ class CC1101Component : public Component,
 
   // GDO pin for packet reception
   InternalGPIOPin *gdo0_pin_{nullptr};
+  static void IRAM_ATTR gpio_intr(CC1101Component *arg);
 
   // Packet handling
   void call_listeners_(const std::vector<uint8_t> &packet, float freq_offset, float rssi, uint8_t lqi);
diff --git a/esphome/components/esphome/ota/__init__.py b/esphome/components/esphome/ota/__init__.py
index 337064dd27..c8cb9920ba 100644
--- a/esphome/components/esphome/ota/__init__.py
+++ b/esphome/components/esphome/ota/__init__.py
@@ -78,6 +78,14 @@ def ota_esphome_final_validate(config):
         else:
             new_ota_conf.append(ota_conf)
 
+    if len(merged_ota_esphome_configs_by_port) > 1:
+        raise cv.Invalid(
+            f"Only a single port is supported for '{CONF_OTA}' "
+            f"'{CONF_PLATFORM}: {CONF_ESPHOME}'. Got ports "
+            f"{sorted(merged_ota_esphome_configs_by_port.keys())}. Consolidate "
+            f"onto a single port; configs sharing a port are merged automatically."
+        )
+
     new_ota_conf.extend(merged_ota_esphome_configs_by_port.values())
 
     full_conf[CONF_OTA] = new_ota_conf
diff --git a/esphome/components/esphome/ota/ota_esphome.cpp b/esphome/components/esphome/ota/ota_esphome.cpp
index c092c757bc..9fa3a8e16a 100644
--- a/esphome/components/esphome/ota/ota_esphome.cpp
+++ b/esphome/components/esphome/ota/ota_esphome.cpp
@@ -15,6 +15,9 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/util.h"
+#ifdef USE_LWIP_FAST_SELECT
+#include "esphome/core/lwip_fast_select.h"
+#endif
 
 #include <cerrno>
 #include <cstdio>
@@ -65,6 +68,20 @@ void ESPHomeOTAComponent::setup() {
     this->server_failed_(LOG_STR("listen"));
     return;
   }
+
+  // Register for socket wake notifications. loop() disables itself on its first
+  // idle tick — no need to disable_loop() here explicitly.
+  App.set_ota_wake_component(this);
+#ifdef USE_LWIP_FAST_SELECT
+  // Install the listener filter so the fast-select RCVPLUS wake hook only fires for
+  // events on this listener's netconn (i.e. new incoming connections). Without this,
+  // every RCVPLUS across all monitored sockets (API client data, mDNS, etc.) would
+  // pay the inline hook's two volatile stores + memw barriers to mark OTA
+  // pending-enable, even though OTA would just re-disable itself on the next tick.
+  // Uses the existing public esphome_lwip_get_sock() lookup instead of adding a
+  // dedicated accessor on Socket — the lookup happens once at setup, not per event.
+  esphome_fast_select_set_ota_listener_sock(esphome_lwip_get_sock(this->server_->get_fd()));
+#endif
 }
 
 void ESPHomeOTAComponent::dump_config() {
@@ -81,13 +98,28 @@ void ESPHomeOTAComponent::dump_config() {
 }
 
 void ESPHomeOTAComponent::loop() {
-  // Skip handle_handshake_() call if no client connected and no incoming connections
-  // This optimization reduces idle loop overhead when OTA is not active
-  // Note: No need to check server_ for null as the component is marked failed in setup()
-  // if server_ creation fails
-  if (this->client_ != nullptr || this->server_->ready()) {
-    this->handle_handshake_();
+  // Self-disabling idle loop. On the first tick after setup() (and after every session
+  // cleanup and every false wake), if there's no client and the listener has nothing
+  // queued, we disable ourselves and go back to sleep. Socket-wake paths (LwIP fast
+  // select, raw TCP accept, host select) mark us pending-enable via
+  // App.wake_ota_component_any_context() when a monitored socket signals activity, and
+  // enable_pending_loops_() reactivates us.
+  //
+  // False wakes from unrelated monitored sockets are expected — the event callbacks
+  // fire on every RCVPLUS across all monitored sockets, not just OTA's listener — and
+  // they land here with no pending work.
+  //
+  // cleanup_connection_() deliberately does NOT call disable_loop() — letting loop()
+  // run one more iteration after a session ends guarantees we re-read server_->ready()
+  // and either accept a client that queued during the session or disable cleanly here.
+  //
+  // Note: No need to check server_ for null — setup() marks the component failed if
+  // server_ creation fails.
+  if (this->client_ == nullptr && !this->server_->ready()) {
+    this->disable_loop();
+    return;
   }
+  this->handle_handshake_();
 }
 
 static const uint8_t FEATURE_SUPPORTS_COMPRESSION = 0x01;
@@ -576,6 +608,12 @@ void ESPHomeOTAComponent::cleanup_connection_() {
 #ifdef USE_OTA_PASSWORD
   this->cleanup_auth_();
 #endif
+  // Do not disable_loop() here. loop() itself disables when idle. If a second
+  // connection was queued on the listener while we were busy, the wake flag was
+  // set while this component was in LOOP state — enable_pending_loops_() only
+  // scans the inactive section and would never clear it. Letting loop() run one
+  // more iteration guarantees we re-check server_->ready() and either accept the
+  // queued client or disable ourselves cleanly.
 }
 
 void ESPHomeOTAComponent::yield_and_feed_watchdog_() {
diff --git a/esphome/components/micro_wake_word/__init__.py b/esphome/components/micro_wake_word/__init__.py
index ff27dec6df..de95e4961b 100644
--- a/esphome/components/micro_wake_word/__init__.py
+++ b/esphome/components/micro_wake_word/__init__.py
@@ -451,6 +451,8 @@ async def to_code(config):
     ota.request_ota_state_listeners()
 
     esp32.add_idf_component(name="espressif/esp-tflite-micro", ref="1.3.3~1")
+    # Pin esp-nn for stable future builds (esp-tflite-micro depends on esp-nn)
+    esp32.add_idf_component(name="espressif/esp-nn", ref="1.2.1")
 
     cg.add_build_flag("-DTF_LITE_STATIC_MEMORY")
     cg.add_build_flag("-DTF_LITE_DISABLE_X86_NEON")
diff --git a/esphome/components/micro_wake_word/streaming_model.cpp b/esphome/components/micro_wake_word/streaming_model.cpp
index 0ab6cd3772..e761e4866f 100644
--- a/esphome/components/micro_wake_word/streaming_model.cpp
+++ b/esphome/components/micro_wake_word/streaming_model.cpp
@@ -29,14 +29,6 @@ void VADModel::log_model_config() {
 bool StreamingModel::load_model_() {
   RAMAllocator<uint8_t> arena_allocator;
 
-  if (this->tensor_arena_ == nullptr) {
-    this->tensor_arena_ = arena_allocator.allocate(this->tensor_arena_size_);
-    if (this->tensor_arena_ == nullptr) {
-      ESP_LOGE(TAG, "Could not allocate the streaming model's tensor arena.");
-      return false;
-    }
-  }
-
   if (this->var_arena_ == nullptr) {
     this->var_arena_ = arena_allocator.allocate(STREAMING_MODEL_VARIABLE_ARENA_SIZE);
     if (this->var_arena_ == nullptr) {
@@ -53,6 +45,26 @@ bool StreamingModel::load_model_() {
     return false;
   }
 
+  // Probe for the actual required tensor arena size if not yet determined
+  if (!this->tensor_arena_size_probed_) {
+    size_t probed_size = this->probe_arena_size_();
+    if (probed_size > 0) {
+      ESP_LOGD(TAG, "Probed tensor arena size: %zu bytes", probed_size);
+      this->tensor_arena_size_ = probed_size;
+    } else {
+      ESP_LOGW(TAG, "Arena size probe failed, using manifest size: %zu bytes", this->tensor_arena_size_);
+    }
+    this->tensor_arena_size_probed_ = true;
+  }
+
+  if (this->tensor_arena_ == nullptr) {
+    this->tensor_arena_ = arena_allocator.allocate(this->tensor_arena_size_);
+    if (this->tensor_arena_ == nullptr) {
+      ESP_LOGE(TAG, "Could not allocate the streaming model's tensor arena.");
+      return false;
+    }
+  }
+
   if (this->interpreter_ == nullptr) {
     this->interpreter_ =
         make_unique<tflite::MicroInterpreter>(tflite::GetModel(this->model_start_), this->streaming_op_resolver_,
@@ -94,6 +106,70 @@ bool StreamingModel::load_model_() {
   return true;
 }
 
+size_t StreamingModel::probe_arena_size_() {
+  RAMAllocator<uint8_t> arena_allocator;
+
+  // Try with the manifest size first, then escalates to 1.5, then 2x if it fails. Different platforms and different
+  // versions of the esp-nn library require different amounts of memory, so the manifest size may not always be correct,
+  // and probing allows us to find the actual required size for the current build and platform. Aligns test sizes to 16
+  // bytes.
+  size_t attempt_sizes[] = {(this->tensor_arena_size_ + 15) & ~15, (this->tensor_arena_size_ * 3 / 2 + 15) & ~15,
+                            (this->tensor_arena_size_ * 2 + 15) & ~15};
+
+  for (size_t attempt_size : attempt_sizes) {
+    uint8_t *probe_arena = arena_allocator.allocate(attempt_size);
+    if (probe_arena == nullptr) {
+      continue;
+    }
+
+    // Verify the model works at all with this arena size
+    auto probe_interpreter = make_unique<tflite::MicroInterpreter>(
+        tflite::GetModel(this->model_start_), this->streaming_op_resolver_, probe_arena, attempt_size, this->mrv_);
+
+    if (probe_interpreter->AllocateTensors() != kTfLiteOk) {
+      probe_interpreter.reset();
+      arena_allocator.deallocate(probe_arena, attempt_size);
+      this->ma_ = tflite::MicroAllocator::Create(this->var_arena_, STREAMING_MODEL_VARIABLE_ARENA_SIZE);
+      this->mrv_ = tflite::MicroResourceVariables::Create(this->ma_, 20);
+      continue;
+    }
+
+    // Try to shrink the arena. Start with arena_used_bytes() + 16 (rounded to 16-byte alignment).
+    // If that works, use it. Otherwise, try midpoints between that and the full size until one succeeds.
+    size_t lower = (probe_interpreter->arena_used_bytes() + 16 + 15) & ~15;
+    probe_interpreter.reset();
+    this->ma_ = tflite::MicroAllocator::Create(this->var_arena_, STREAMING_MODEL_VARIABLE_ARENA_SIZE);
+    this->mrv_ = tflite::MicroResourceVariables::Create(this->ma_, 20);
+
+    size_t upper = attempt_size;
+
+    while (lower < upper) {
+      auto test_interpreter = make_unique<tflite::MicroInterpreter>(
+          tflite::GetModel(this->model_start_), this->streaming_op_resolver_, probe_arena, lower, this->mrv_);
+
+      bool ok = test_interpreter->AllocateTensors() == kTfLiteOk;
+
+      test_interpreter.reset();
+      this->ma_ = tflite::MicroAllocator::Create(this->var_arena_, STREAMING_MODEL_VARIABLE_ARENA_SIZE);
+      this->mrv_ = tflite::MicroResourceVariables::Create(this->ma_, 20);
+
+      if (ok) {
+        // Found a working size smaller than the full arena
+        upper = lower + 16;  // Pad by 16 bytes to be safe for future allocations
+        break;
+      }
+
+      // Try the midpoint between current attempt and full size
+      lower = ((lower + upper) / 2 + 15) & ~15;
+    }
+
+    arena_allocator.deallocate(probe_arena, attempt_size);
+    return upper;
+  }
+
+  return 0;
+}
+
 void StreamingModel::unload_model() {
   this->interpreter_.reset();
 
diff --git a/esphome/components/micro_wake_word/streaming_model.h b/esphome/components/micro_wake_word/streaming_model.h
index 0811bfb19b..fc9eeb5e2d 100644
--- a/esphome/components/micro_wake_word/streaming_model.h
+++ b/esphome/components/micro_wake_word/streaming_model.h
@@ -63,6 +63,10 @@ class StreamingModel {
   /// @brief Allocates tensor and variable arenas and sets up the model interpreter
   /// @return True if successful, false otherwise
   bool load_model_();
+  /// @brief Probes the actual required tensor arena size by trial allocation.
+  /// Tries the manifest size first, then 2x if that fails.
+  /// @return The required arena size rounded up to 16-byte alignment, or 0 on failure.
+  size_t probe_arena_size_();
   /// @brief Returns true if successfully registered the streaming model's TensorFlow operations
   bool register_streaming_ops_(tflite::MicroMutableOpResolver<20> &op_resolver);
 
@@ -70,6 +74,7 @@ class StreamingModel {
 
   bool loaded_{false};
   bool enabled_{true};
+  bool tensor_arena_size_probed_{false};
   bool unprocessed_probability_status_{false};
   uint8_t current_stride_step_{0};
   int16_t ignore_windows_{-MIN_SLICES_BEFORE_DETECTION};
diff --git a/esphome/components/ota/__init__.py b/esphome/components/ota/__init__.py
index 8f31eb5cdd..3abfd2c69e 100644
--- a/esphome/components/ota/__init__.py
+++ b/esphome/components/ota/__init__.py
@@ -103,6 +103,12 @@ BASE_OTA_SCHEMA = cv.Schema(
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config):
     cg.add_define("USE_OTA")
+    # Separate compiler -D flag using an ESPHOME_-prefixed name so .c translation units
+    # (which cannot include defines.h because macros.h → Arduino.h breaks the C compile
+    # under Arduino builds) can still tell OTA is compiled in. Needed by the fast-select
+    # OTA wake hook in lwip_fast_select.c. A distinct name avoids the "USE_OTA redefined"
+    # warning that would fire if we also emitted -DUSE_OTA — defines.h already has it.
+    cg.add_build_flag("-DESPHOME_USE_OTA")
     CORE.add_job(final_step)
 
     if CORE.is_rp2040 and CORE.using_arduino:
diff --git a/esphome/components/rp2040/helpers.cpp b/esphome/components/rp2040/helpers.cpp
index 3a53eba61b..6e5ddad236 100644
--- a/esphome/components/rp2040/helpers.cpp
+++ b/esphome/components/rp2040/helpers.cpp
@@ -9,7 +9,7 @@
 #include <WiFi.h>
 #include <pico/cyw43_arch.h>  // For cyw43_arch_lwip_begin/end (LwIPLock)
 #elif defined(USE_ETHERNET)
-#include <lwip_wrap.h>  // For LWIPMutex — LwIPLock delegates to it (see below)
+#include <lwip_wrap.h>  // For LWIPMutex — LwIPLock mirrors its semantics (see below)
 #include "esphome/components/ethernet/ethernet_component.h"
 #endif
 #include <hardware/structs/rosc.h>
diff --git a/esphome/components/socket/lwip_raw_tcp_impl.cpp b/esphome/components/socket/lwip_raw_tcp_impl.cpp
index 86131d3ddb..08de3f73a8 100644
--- a/esphome/components/socket/lwip_raw_tcp_impl.cpp
+++ b/esphome/components/socket/lwip_raw_tcp_impl.cpp
@@ -10,6 +10,9 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/wake.h"
 #include "esphome/core/log.h"
+#ifdef USE_OTA
+#include "esphome/core/application.h"  // for App.wake_ota_component_any_context()
+#endif
 
 #ifdef USE_ESP8266
 #include <coredecls.h>  // For esp_schedule()
@@ -854,6 +857,16 @@ err_t LWIPRawListenImpl::accept_fn_(struct tcp_pcb *newpcb, err_t err) {
   tcp_err(newpcb, LWIPRawListenImpl::s_queued_err_fn);
   tcp_recv(newpcb, LWIPRawListenImpl::s_queued_recv_fn);
   LWIP_LOG("Accepted connection, queue size: %d", this->accepted_socket_count_);
+#ifdef USE_OTA
+  // Mark the OTA component loop to be re-enabled if it disabled itself while idle.
+  // This MUST happen before wake_loop_any_context() below — otherwise the main loop
+  // could wake, run a full iteration, and finish before we set the pending-enable
+  // flags, losing the wake event. accept_fn_ only fires for the specific listener
+  // pcb it was registered on, so there's implicit filtering here (no "false wakes"
+  // from unrelated sockets, unlike the fast-select path). Safe from RP2040's
+  // low-priority user IRQ context — only writes a volatile bool, no locks.
+  esphome::App.wake_ota_component_any_context();
+#endif
   // Wake the main loop immediately so it can accept the new connection.
   esphome::wake_loop_any_context();
   return ERR_OK;
diff --git a/esphome/components/sx126x/sx126x.cpp b/esphome/components/sx126x/sx126x.cpp
index ec62fad10a..6ea09e3a9e 100644
--- a/esphome/components/sx126x/sx126x.cpp
+++ b/esphome/components/sx126x/sx126x.cpp
@@ -104,11 +104,17 @@ void SX126x::write_register_(uint16_t reg, uint8_t *data, uint8_t size) {
   delayMicroseconds(SWITCHING_DELAY_US);
 }
 
+void IRAM_ATTR SX126x::gpio_intr(SX126x *arg) { arg->enable_loop_soon_any_context(); }
+
 void SX126x::setup() {
   // setup pins
   this->busy_pin_->setup();
   this->rst_pin_->setup();
   this->dio1_pin_->setup();
+  if (this->dio1_pin_->is_internal()) {
+    static_cast<InternalGPIOPin *>(this->dio1_pin_)
+        ->attach_interrupt(&SX126x::gpio_intr, this, gpio::INTERRUPT_RISING_EDGE);
+  }
 
   // start spi
   this->spi_setup();
@@ -348,6 +354,9 @@ void SX126x::call_listeners_(const std::vector<uint8_t> &packet, float rssi, flo
 }
 
 void SX126x::loop() {
+  if (this->dio1_pin_->is_internal()) {
+    this->disable_loop();
+  }
   if (!this->dio1_pin_->digital_read()) {
     return;
   }
diff --git a/esphome/components/sx126x/sx126x.h b/esphome/components/sx126x/sx126x.h
index a758d63795..edc00e3727 100644
--- a/esphome/components/sx126x/sx126x.h
+++ b/esphome/components/sx126x/sx126x.h
@@ -3,6 +3,7 @@
 #include "esphome/components/spi/spi.h"
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
+#include "esphome/core/hal.h"
 #include "sx126x_reg.h"
 #include <utility>
 #include <vector>
@@ -100,6 +101,7 @@ class SX126x : public Component,
   Trigger<std::vector<uint8_t>, float, float> *get_packet_trigger() { return &this->packet_trigger_; }
 
  protected:
+  static void IRAM_ATTR gpio_intr(SX126x *arg);
   void configure_fsk_ook_();
   void configure_lora_();
   void set_packet_params_(uint8_t payload_length);
diff --git a/esphome/components/sx127x/sx127x.cpp b/esphome/components/sx127x/sx127x.cpp
index 83be96767a..2b13efb38d 100644
--- a/esphome/components/sx127x/sx127x.cpp
+++ b/esphome/components/sx127x/sx127x.cpp
@@ -53,6 +53,8 @@ void SX127x::write_fifo_(const std::vector<uint8_t> &packet) {
   this->disable();
 }
 
+void IRAM_ATTR SX127x::gpio_intr(SX127x *arg) { arg->enable_loop_soon_any_context(); }
+
 void SX127x::setup() {
   // setup reset
   this->rst_pin_->setup();
@@ -60,6 +62,7 @@ void SX127x::setup() {
   // setup dio0
   if (this->dio0_pin_) {
     this->dio0_pin_->setup();
+    this->dio0_pin_->attach_interrupt(&SX127x::gpio_intr, this, gpio::INTERRUPT_RISING_EDGE);
   }
 
   // start spi
@@ -313,6 +316,7 @@ void SX127x::call_listeners_(const std::vector<uint8_t> &packet, float rssi, flo
 }
 
 void SX127x::loop() {
+  this->disable_loop();
   if (this->dio0_pin_ == nullptr || !this->dio0_pin_->digital_read()) {
     return;
   }
@@ -386,11 +390,6 @@ void SX127x::set_mode_(uint8_t modulation, uint8_t mode) {
       return;
     }
   }
-  if (mode == MODE_RX && (modulation == MOD_LORA || this->packet_mode_)) {
-    this->enable_loop();
-  } else {
-    this->disable_loop();
-  }
 }
 
 void SX127x::set_mode_rx() {
diff --git a/esphome/components/sx127x/sx127x.h b/esphome/components/sx127x/sx127x.h
index be7b6d8d9f..76f942fdda 100644
--- a/esphome/components/sx127x/sx127x.h
+++ b/esphome/components/sx127x/sx127x.h
@@ -4,6 +4,7 @@
 #include "esphome/components/spi/spi.h"
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
+#include "esphome/core/hal.h"
 #include <vector>
 
 namespace esphome {
@@ -86,6 +87,7 @@ class SX127x : public Component,
   Trigger<std::vector<uint8_t>, float, float> *get_packet_trigger() { return &this->packet_trigger_; }
 
  protected:
+  static void IRAM_ATTR gpio_intr(SX127x *arg);
   void configure_fsk_ook_();
   void configure_lora_();
   void set_mode_(uint8_t modulation, uint8_t mode);
diff --git a/esphome/core/application.cpp b/esphome/core/application.cpp
index cd75859880..ffb374b321 100644
--- a/esphome/core/application.cpp
+++ b/esphome/core/application.cpp
@@ -449,6 +449,14 @@ void Application::enable_pending_loops_() {
   }
 }
 
+#if defined(USE_OTA) && defined(USE_LWIP_FAST_SELECT)
+// Extern-C trampoline for the lwip fast-select callback to reach the C++ wake method.
+// Invoked only when the listener filter in lwip_fast_select.c matches — i.e. only on
+// actual incoming connections to the OTA listen socket — so the function-call overhead
+// here is paid at most once per real OTA attempt, not on every monitored-socket event.
+extern "C" void esphome_wake_ota_component_any_context() { App.wake_ota_component_any_context(); }
+#endif
+
 #ifdef USE_LWIP_FAST_SELECT
 bool Application::register_socket(struct lwip_sock *sock) {
   // It modifies monitored_sockets_ without locking — must only be called from the main loop.
@@ -554,6 +562,16 @@ void Application::yield_with_select_(uint32_t delay_ms) {
     // ret > 0: socket(s) have data ready - normal and expected
     // ret == 0: timeout occurred - normal and expected
     if (ret >= 0) [[likely]] {
+#ifdef USE_OTA
+      // Dead code today — host does not currently support the esphome OTA platform,
+      // so ota_wake_component_ is always null and this is a no-op. Kept so the wake
+      // path works out of the box if host ever gains OTA support. Host has no listener
+      // filter (that lives in lwip_fast_select.c, ESP32/LibreTiny only), so any
+      // ret > 0 fires this — harmless when the pointer is null.
+      if (ret > 0) {
+        this->wake_ota_component_any_context();
+      }
+#endif
       // Yield if zero timeout since select(0) only polls without yielding
       if (delay_ms == 0) [[unlikely]] {
         yield();
diff --git a/esphome/core/application.h b/esphome/core/application.h
index 317631d62c..681c6b9c3a 100644
--- a/esphome/core/application.h
+++ b/esphome/core/application.h
@@ -317,6 +317,26 @@ class Application {
   /// Wake from any context (ISR, thread, callback).
   static void IRAM_ATTR wake_loop_any_context() { esphome::wake_loop_any_context(); }
 
+#ifdef USE_OTA
+  /// Register the OTA component so socket-wake paths can enable its loop when a new
+  /// connection arrives on the listening socket. OTA calls this once from setup();
+  /// the component self-disables its loop on its first idle tick and is re-enabled
+  /// via wake_ota_component_any_context() when the fast-select filter in
+  /// lwip_fast_select.c matches an incoming connection on the OTA listener.
+  void set_ota_wake_component(Component *component) { this->ota_wake_component_ = component; }
+  /// Mark the registered OTA component pending loop-enable. Called from the LwIP
+  /// TCP/IP task (fast-select callback), raw-TCP accept callback, and host select
+  /// return path — all task / user-IRQ context, not a real ISR. Does NOT wake the
+  /// main task itself: every caller already does so separately. Application is a
+  /// friend of Component, so we set pending_enable_loop_ directly.
+  void wake_ota_component_any_context() {
+    if (this->ota_wake_component_ != nullptr) {
+      this->ota_wake_component_->pending_enable_loop_ = true;
+      this->has_pending_enable_loop_requests_ = true;
+    }
+  }
+#endif
+
  protected:
   friend Component;
 #ifdef USE_HOST
@@ -392,6 +412,9 @@ class Application {
 
   // Pointer-sized members first
   Component *current_component_{nullptr};
+#ifdef USE_OTA
+  Component *ota_wake_component_{nullptr};  // Set by ESPHomeOTAComponent to receive socket-wake notifications
+#endif
 
   // std::vector (3 pointers each: begin, end, capacity)
   // Partitioned vector design for looping components
diff --git a/esphome/core/lwip_fast_select.c b/esphome/core/lwip_fast_select.c
index bb3acbafcb..9f23401aba 100644
--- a/esphome/core/lwip_fast_select.c
+++ b/esphome/core/lwip_fast_select.c
@@ -157,6 +157,29 @@ _Static_assert(offsetof(struct lwip_sock, rcvevent) == ESPHOME_LWIP_SOCK_RCVEVEN
 // Saved original event_callback pointer — written once in first hook_socket(), read from TCP/IP task.
 static netconn_callback s_original_callback = NULL;
 
+#ifdef ESPHOME_USE_OTA
+// OTA listener netconn, captured via esphome_fast_select_set_ota_listener_sock() at OTA
+// setup(). The wake hook only fires when the callback's `conn` argument matches this
+// pointer — i.e. only for RCVPLUS events on the OTA listen socket (new accepts). Avoids
+// paying the wake-hook function call on every API client data packet, mDNS query, etc.
+static struct netconn *s_ota_listener_conn = NULL;
+
+// Extern-C trampoline defined in application.cpp — calls App.wake_ota_component_any_context()
+// to mark the OTA component pending loop-enable. Out-of-line (not inlined) because with the
+// listener filter above, this only fires on actual OTA connection attempts — the function-call
+// cost is paid at most once per real wake, not on every monitored-socket RCVPLUS.
+// ESPHOME_USE_OTA (not USE_OTA) because USE_OTA only lives in defines.h, and this .c file
+// cannot include defines.h — macros.h → Arduino.h would break the C compile under Arduino
+// builds. ota/__init__.py emits -DESPHOME_USE_OTA as a build flag so this file can see it.
+extern void esphome_wake_ota_component_any_context(void);
+
+void esphome_fast_select_set_ota_listener_sock(struct lwip_sock *sock) {
+  s_ota_listener_conn = (sock != NULL) ? sock->conn : NULL;
+}
+#else
+void esphome_fast_select_set_ota_listener_sock(struct lwip_sock *sock) { (void) sock; }
+#endif
+
 // Wrapper callback: calls original event_callback + notifies main loop task.
 // Called from LwIP's TCP/IP thread when socket events occur (task context, not ISR).
 static void esphome_socket_event_callback(struct netconn *conn, enum netconn_evt evt, u16_t len) {
@@ -171,6 +194,18 @@ static void esphome_socket_event_callback(struct netconn *conn, enum netconn_evt
   // (rcvevent++ with a NULL pbuf or error in recvmbox), so error conditions
   // already wake the main loop through the RCVPLUS path.
   if (evt == NETCONN_EVT_RCVPLUS) {
+#ifdef ESPHOME_USE_OTA
+    // Filter: only mark OTA pending-enable when the event is for OTA's listen socket.
+    // Without this, every RCVPLUS (API client data, mDNS, etc.) would pay the inline
+    // wake hook's two volatile stores + memw barriers. The setter that installs
+    // s_ota_listener_conn is called from OTA setup(); until then the pointer is NULL
+    // and the filter skips the wake work entirely, which is the correct idle behavior.
+    // MUST happen before xTaskNotifyGive below — the flags have to be visible before
+    // the main task wakes, or the main loop could run a full iteration and miss them.
+    if (conn == s_ota_listener_conn) {
+      esphome_wake_ota_component_any_context();
+    }
+#endif
     TaskHandle_t task = esphome_main_task_handle;
     if (task != NULL) {
       xTaskNotifyGive(task);
diff --git a/esphome/core/lwip_fast_select.h b/esphome/core/lwip_fast_select.h
index 20ac191673..9e1438ecdd 100644
--- a/esphome/core/lwip_fast_select.h
+++ b/esphome/core/lwip_fast_select.h
@@ -53,6 +53,14 @@ static inline bool esphome_lwip_socket_has_data(struct lwip_sock *sock) {
 /// The sock pointer must have been obtained from esphome_lwip_get_sock().
 void esphome_lwip_hook_socket(struct lwip_sock *sock);
 
+/// Filter the inline OTA wake hook in the fast-select callback so it only fires for
+/// RCVPLUS events on this specific listener's netconn. Without this, every monitored
+/// socket's RCVPLUS (API client data, web server, mDNS, etc.) would mark OTA
+/// pending-enable and force its loop to run a wake-up tick only to re-disable itself.
+/// Captured at OTA setup(); stays pointing at the listener for the device's lifetime.
+/// Pass NULL to clear the filter (wake fires on every RCVPLUS, pre-filter behavior).
+void esphome_fast_select_set_ota_listener_sock(struct lwip_sock *sock);
+
 /// Set or clear TCP_NODELAY on a socket's tcp_pcb directly.
 /// Must be called with the TCPIP core lock held (LwIPLock in C++).
 /// This bypasses lwip_setsockopt() overhead (socket lookups, switch cascade,
diff --git a/requirements.txt b/requirements.txt
index d7db44454c..8f8ada561a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -19,7 +19,7 @@ ruamel.yaml==0.19.1 # dashboard_import
 ruamel.yaml.clib==0.2.15 # dashboard_import
 esphome-glyphsets==0.2.0
 pillow==12.2.0
-resvg-py==0.2.6
+resvg-py==0.3.0
 freetype-py==2.5.1
 jinja2==3.1.6
 bleak==2.1.1
diff --git a/tests/component_tests/ota/test_esphome_ota.py b/tests/component_tests/ota/test_esphome_ota.py
new file mode 100644
index 0000000000..cdac430ff7
--- /dev/null
+++ b/tests/component_tests/ota/test_esphome_ota.py
@@ -0,0 +1,105 @@
+"""Tests for the esphome OTA platform final_validate logic."""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+import pytest
+
+from esphome import config_validation as cv
+from esphome.components.esphome.ota import ota_esphome_final_validate
+from esphome.const import (
+    CONF_ESPHOME,
+    CONF_ID,
+    CONF_OTA,
+    CONF_PASSWORD,
+    CONF_PLATFORM,
+    CONF_PORT,
+    CONF_VERSION,
+)
+from esphome.core import ID
+import esphome.final_validate as fv
+
+
+def _make_ota_config(port: int = 3232, **kwargs: Any) -> dict[str, Any]:
+    config: dict[str, Any] = {
+        CONF_PLATFORM: CONF_ESPHOME,
+        CONF_ID: ID(f"ota_esphome_{port}", is_manual=False),
+        CONF_VERSION: 2,
+        CONF_PORT: port,
+    }
+    config.update(kwargs)
+    return config
+
+
+def test_single_esphome_ota_instance_accepted() -> None:
+    """A single ESPHome OTA config passes final_validate untouched."""
+    full_conf = {CONF_OTA: [_make_ota_config(port=3232)]}
+    token = fv.full_config.set(full_conf)
+    try:
+        ota_esphome_final_validate({})
+        updated = fv.full_config.get()
+        assert len(updated[CONF_OTA]) == 1
+        assert updated[CONF_OTA][0][CONF_PORT] == 3232
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_same_port_configs_merge(caplog: pytest.LogCaptureFixture) -> None:
+    """Two ESPHome OTA configs on the same port merge into one instance."""
+    full_conf = {
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_PASSWORD: "pw"}),
+            _make_ota_config(port=3232),
+        ]
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        updated = fv.full_config.get()
+        assert len(updated[CONF_OTA]) == 1
+        assert updated[CONF_OTA][0][CONF_PORT] == 3232
+        assert any("Found and merged" in record.message for record in caplog.records), (
+            "Expected merge warning not found in log"
+        )
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_multiple_ports_rejected() -> None:
+    """Two ESPHome OTA configs on different ports raise cv.Invalid."""
+    full_conf = {
+        CONF_OTA: [
+            _make_ota_config(port=3232),
+            _make_ota_config(port=3233),
+        ]
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with pytest.raises(
+            cv.Invalid,
+            match=r"Only a single port is supported for 'ota' 'platform: esphome'",
+        ):
+            ota_esphome_final_validate({})
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_non_esphome_ota_unaffected() -> None:
+    """Non-esphome OTA platforms are not subject to the single-instance rule."""
+    full_conf = {
+        CONF_OTA: [
+            _make_ota_config(port=3232),
+            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
+            {CONF_PLATFORM: "http_request", CONF_ID: ID("ota_hr", is_manual=False)},
+        ]
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        ota_esphome_final_validate({})
+        updated = fv.full_config.get()
+        assert len(updated[CONF_OTA]) == 3
+    finally:
+        fv.full_config.reset(token)