still de-dupe

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2025.11.0-dev
+PROJECT_NUMBER         = 2025.11.0b1
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

esphome/components/api/api_connection.cpp

@@ -1294,11 +1294,11 @@ void APIConnection::alarm_control_panel_command(const AlarmControlPanelCommandRe
 #endif
 
 #ifdef USE_EVENT
-void APIConnection::send_event(event::Event *event, const std::string &event_type) {
+void APIConnection::send_event(event::Event *event, const char *event_type) {
   this->schedule_message_(event, MessageCreator(event_type), EventResponse::MESSAGE_TYPE,
                           EventResponse::ESTIMATED_SIZE);
 }
-uint16_t APIConnection::try_send_event_response(event::Event *event, const std::string &event_type, APIConnection *conn,
+uint16_t APIConnection::try_send_event_response(event::Event *event, const char *event_type, APIConnection *conn,
                                                 uint32_t remaining_size, bool is_single) {
   EventResponse resp;
   resp.set_event_type(StringRef(event_type));
@@ -1650,9 +1650,7 @@ void APIConnection::DeferredBatch::add_item(EntityBase *entity, MessageCreator c
   // O(n) but optimized for RAM and not performance.
   for (auto &item : items) {
     if (item.entity == entity && item.message_type == message_type) {
-      // Clean up old creator before replacing
-      item.creator.cleanup(message_type);
-      // Move assign the new creator
+      // Replace with new creator
       item.creator = std::move(creator);
       return;
     }
@@ -1822,7 +1820,7 @@ void APIConnection::process_batch_() {
 
   // Handle remaining items more efficiently
   if (items_processed < this->deferred_batch_.size()) {
-    // Remove processed items from the beginning with proper cleanup
+    // Remove processed items from the beginning
     this->deferred_batch_.remove_front(items_processed);
     // Reschedule for remaining items
     this->schedule_batch_();
@@ -1835,10 +1833,10 @@ void APIConnection::process_batch_() {
 uint16_t APIConnection::MessageCreator::operator()(EntityBase *entity, APIConnection *conn, uint32_t remaining_size,
                                                    bool is_single, uint8_t message_type) const {
 #ifdef USE_EVENT
-  // Special case: EventResponse uses string pointer
+  // Special case: EventResponse uses const char * pointer
   if (message_type == EventResponse::MESSAGE_TYPE) {
     auto *e = static_cast<event::Event *>(entity);
-    return APIConnection::try_send_event_response(e, *data_.string_ptr, conn, remaining_size, is_single);
+    return APIConnection::try_send_event_response(e, data_.const_char_ptr, conn, remaining_size, is_single);
   }
 #endif
 

esphome/components/api/api_connection.h

@@ -177,7 +177,7 @@ class APIConnection final : public APIServerConnection {
 #endif
 
 #ifdef USE_EVENT
-  void send_event(event::Event *event, const std::string &event_type);
+  void send_event(event::Event *event, const char *event_type);
 #endif
 
 #ifdef USE_UPDATE
@@ -450,7 +450,7 @@ class APIConnection final : public APIServerConnection {
                                                     bool is_single);
 #endif
 #ifdef USE_EVENT
-  static uint16_t try_send_event_response(event::Event *event, const std::string &event_type, APIConnection *conn,
+  static uint16_t try_send_event_response(event::Event *event, const char *event_type, APIConnection *conn,
                                           uint32_t remaining_size, bool is_single);
   static uint16_t try_send_event_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size, bool is_single);
 #endif
@@ -508,10 +508,8 @@ class APIConnection final : public APIServerConnection {
     // Constructor for function pointer
     MessageCreator(MessageCreatorPtr ptr) { data_.function_ptr = ptr; }
 
-    // Constructor for string state capture
-    explicit MessageCreator(const std::string &str_value) { data_.string_ptr = new std::string(str_value); }
-
-    // No destructor - cleanup must be called explicitly with message_type
+    // Constructor for const char * (Event types - no allocation needed)
+    explicit MessageCreator(const char *str_value) { data_.const_char_ptr = str_value; }
 
     // Delete copy operations - MessageCreator should only be moved
     MessageCreator(const MessageCreator &other) = delete;
@@ -523,8 +521,6 @@ class APIConnection final : public APIServerConnection {
     // Move assignment
     MessageCreator &operator=(MessageCreator &&other) noexcept {
       if (this != &other) {
-        // IMPORTANT: Caller must ensure cleanup() was called if this contains a string!
-        // In our usage, this happens in add_item() deduplication and vector::erase()
         data_ = other.data_;
         other.data_.function_ptr = nullptr;
       }
@@ -535,20 +531,10 @@ class APIConnection final : public APIServerConnection {
     uint16_t operator()(EntityBase *entity, APIConnection *conn, uint32_t remaining_size, bool is_single,
                         uint8_t message_type) const;
 
-    // Manual cleanup method - must be called before destruction for string types
-    void cleanup(uint8_t message_type) {
-#ifdef USE_EVENT
-      if (message_type == EventResponse::MESSAGE_TYPE && data_.string_ptr != nullptr) {
-        delete data_.string_ptr;
-        data_.string_ptr = nullptr;
-      }
-#endif
-    }
-
    private:
     union Data {
       MessageCreatorPtr function_ptr;
-      std::string *string_ptr;
+      const char *const_char_ptr;
     } data_;  // 4 bytes on 32-bit, 8 bytes on 64-bit - same as before
   };
 
@@ -568,42 +554,24 @@ class APIConnection final : public APIServerConnection {
     std::vector<BatchItem> items;
     uint32_t batch_start_time{0};
 
-   private:
-    // Helper to cleanup items from the beginning
-    void cleanup_items_(size_t count) {
-      for (size_t i = 0; i < count; i++) {
-        items[i].creator.cleanup(items[i].message_type);
-      }
-    }
-
-   public:
     DeferredBatch() {
       // Pre-allocate capacity for typical batch sizes to avoid reallocation
       items.reserve(8);
     }
 
-    ~DeferredBatch() {
-      // Ensure cleanup of any remaining items
-      clear();
-    }
-
     // Add item to the batch
     void add_item(EntityBase *entity, MessageCreator creator, uint8_t message_type, uint8_t estimated_size);
     // Add item to the front of the batch (for high priority messages like ping)
     void add_item_front(EntityBase *entity, MessageCreator creator, uint8_t message_type, uint8_t estimated_size);
 
-    // Clear all items with proper cleanup
+    // Clear all items
     void clear() {
-      cleanup_items_(items.size());
       items.clear();
       batch_start_time = 0;
     }
 
-    // Remove processed items from the front with proper cleanup
-    void remove_front(size_t count) {
-      cleanup_items_(count);
-      items.erase(items.begin(), items.begin() + count);
-    }
+    // Remove processed items from the front
+    void remove_front(size_t count) { items.erase(items.begin(), items.begin() + count); }
 
     bool empty() const { return items.empty(); }
     size_t size() const { return items.size(); }

esphome/components/captive_portal/__init__.py

@@ -1,9 +1,12 @@
+import logging
+
 import esphome.codegen as cg
 from esphome.components import web_server_base
 from esphome.components.web_server_base import CONF_WEB_SERVER_BASE_ID
 from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
 from esphome.const import (
+    CONF_AP,
     CONF_ID,
     PLATFORM_BK72XX,
     PLATFORM_ESP32,
@@ -14,6 +17,10 @@ from esphome.const import (
 )
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
+import esphome.final_validate as fv
+from esphome.types import ConfigType
+
+_LOGGER = logging.getLogger(__name__)
 
 
 def AUTO_LOAD() -> list[str]:
@@ -50,6 +57,27 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+def _final_validate(config: ConfigType) -> ConfigType:
+    full_config = fv.full_config.get()
+    wifi_conf = full_config.get("wifi")
+
+    if wifi_conf is None:
+        # This shouldn't happen due to DEPENDENCIES = ["wifi"], but check anyway
+        raise cv.Invalid("Captive portal requires the wifi component to be configured")
+
+    if CONF_AP not in wifi_conf:
+        _LOGGER.warning(
+            "Captive portal is enabled but no WiFi AP is configured. "
+            "The captive portal will not be accessible. "
+            "Add 'ap:' to your WiFi configuration to enable the captive portal."
+        )
+
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _final_validate
+
+
 @coroutine_with_priority(CoroPriority.CAPTIVE_PORTAL)
 async def to_code(config):
     paren = await cg.get_variable(config[CONF_WEB_SERVER_BASE_ID])

esphome/components/debug/debug_component.cpp

@@ -49,9 +49,9 @@ void DebugComponent::dump_config() {
   }
 #endif  // USE_TEXT_SENSOR
 
-#ifdef USE_ESP32
-  this->log_partition_info_();  // Log partition information for ESP32
-#endif                          // USE_ESP32
+#if defined(USE_ESP32) || defined(USE_ZEPHYR)
+  this->log_partition_info_();  // Log partition information
+#endif
 }
 
 void DebugComponent::loop() {

esphome/components/debug/debug_component.h

@@ -62,19 +62,19 @@ class DebugComponent : public PollingComponent {
   sensor::Sensor *cpu_frequency_sensor_{nullptr};
 #endif  // USE_SENSOR
 
-#ifdef USE_ESP32
+#if defined(USE_ESP32) || defined(USE_ZEPHYR)
   /**
    * @brief Logs information about the device's partition table.
    *
-   * This function iterates through the ESP32's partition table and logs details
+   * This function iterates through the partition table and logs details
    * about each partition, including its name, type, subtype, starting address,
    * and size. The information is useful for diagnosing issues related to flash
    * memory or verifying the partition configuration dynamically at runtime.
    *
-   * Only available when compiled for ESP32 platforms.
+   * Only available when compiled for ESP32 and ZEPHYR platforms.
    */
   void log_partition_info_();
-#endif  // USE_ESP32
+#endif
 
 #ifdef USE_TEXT_SENSOR
   text_sensor::TextSensor *device_info_{nullptr};

esphome/components/debug/debug_zephyr.cpp

@@ -5,6 +5,7 @@
 #include <zephyr/drivers/hwinfo.h>
 #include <hal/nrf_power.h>
 #include <cstdint>
+#include <zephyr/storage/flash_map.h>
 
 #define BOOTLOADER_VERSION_REGISTER NRF_TIMER2->CC[0]
 
@@ -86,6 +87,37 @@ std::string DebugComponent::get_reset_reason_() {
 
 uint32_t DebugComponent::get_free_heap_() { return INT_MAX; }
 
+static void fa_cb(const struct flash_area *fa, void *user_data) {
+#if CONFIG_FLASH_MAP_LABELS
+  const char *fa_label = flash_area_label(fa);
+
+  if (fa_label == nullptr) {
+    fa_label = "-";
+  }
+  ESP_LOGCONFIG(TAG, "%2d   0x%0*" PRIxPTR "   %-26s  %-24.24s  0x%-10x 0x%-12x", (int) fa->fa_id,
+                sizeof(uintptr_t) * 2, (uintptr_t) fa->fa_dev, fa->fa_dev->name, fa_label, (uint32_t) fa->fa_off,
+                fa->fa_size);
+#else
+  ESP_LOGCONFIG(TAG, "%2d   0x%0*" PRIxPTR "   %-26s  0x%-10x 0x%-12x", (int) fa->fa_id, sizeof(uintptr_t) * 2,
+                (uintptr_t) fa->fa_dev, fa->fa_dev->name, (uint32_t) fa->fa_off, fa->fa_size);
+#endif
+}
+
+void DebugComponent::log_partition_info_() {
+#if CONFIG_FLASH_MAP_LABELS
+  ESP_LOGCONFIG(TAG, "ID | Device     | Device Name               "
+                     "| Label                   | Offset     | Size");
+  ESP_LOGCONFIG(TAG, "--------------------------------------------"
+                     "-----------------------------------------------");
+#else
+  ESP_LOGCONFIG(TAG, "ID | Device     | Device Name               "
+                     "| Offset     | Size");
+  ESP_LOGCONFIG(TAG, "-----------------------------------------"
+                     "------------------------------");
+#endif
+  flash_area_foreach(fa_cb, nullptr);
+}
+
 void DebugComponent::get_device_info_(std::string &device_info) {
   std::string supply = "Main supply status: ";
   if (nrf_power_mainregstatus_get(NRF_POWER) == NRF_POWER_MAINREGSTATUS_NORMAL) {

esphome/components/esp32/__init__.py

@@ -334,12 +334,14 @@ def _is_framework_url(source: str) -> str:
 #  - https://github.com/espressif/arduino-esp32/releases
 ARDUINO_FRAMEWORK_VERSION_LOOKUP = {
     "recommended": cv.Version(3, 3, 2),
-    "latest": cv.Version(3, 3, 2),
-    "dev": cv.Version(3, 3, 2),
+    "latest": cv.Version(3, 3, 4),
+    "dev": cv.Version(3, 3, 4),
 }
 ARDUINO_PLATFORM_VERSION_LOOKUP = {
-    cv.Version(3, 3, 2): cv.Version(55, 3, 31, "1"),
-    cv.Version(3, 3, 1): cv.Version(55, 3, 31, "1"),
+    cv.Version(3, 3, 4): cv.Version(55, 3, 31, "2"),
+    cv.Version(3, 3, 3): cv.Version(55, 3, 31, "2"),
+    cv.Version(3, 3, 2): cv.Version(55, 3, 31, "2"),
+    cv.Version(3, 3, 1): cv.Version(55, 3, 31, "2"),
     cv.Version(3, 3, 0): cv.Version(55, 3, 30, "2"),
     cv.Version(3, 2, 1): cv.Version(54, 3, 21, "2"),
     cv.Version(3, 2, 0): cv.Version(54, 3, 20),
@@ -357,8 +359,8 @@ ESP_IDF_FRAMEWORK_VERSION_LOOKUP = {
     "dev": cv.Version(5, 5, 1),
 }
 ESP_IDF_PLATFORM_VERSION_LOOKUP = {
-    cv.Version(5, 5, 1): cv.Version(55, 3, 31, "1"),
-    cv.Version(5, 5, 0): cv.Version(55, 3, 31, "1"),
+    cv.Version(5, 5, 1): cv.Version(55, 3, 31, "2"),
+    cv.Version(5, 5, 0): cv.Version(55, 3, 31, "2"),
     cv.Version(5, 4, 3): cv.Version(55, 3, 32),
     cv.Version(5, 4, 2): cv.Version(54, 3, 21, "2"),
     cv.Version(5, 4, 1): cv.Version(54, 3, 21, "2"),
@@ -373,9 +375,9 @@ ESP_IDF_PLATFORM_VERSION_LOOKUP = {
 # The platform-espressif32 version
 #  - https://github.com/pioarduino/platform-espressif32/releases
 PLATFORM_VERSION_LOOKUP = {
-    "recommended": cv.Version(55, 3, 31, "1"),
-    "latest": cv.Version(55, 3, 31, "1"),
-    "dev": cv.Version(55, 3, 31, "1"),
+    "recommended": cv.Version(55, 3, 31, "2"),
+    "latest": cv.Version(55, 3, 31, "2"),
+    "dev": cv.Version(55, 3, 31, "2"),
 }
 
 

esphome/components/esp32_ble/ble.cpp

@@ -634,11 +634,13 @@ void ESP32BLE::dump_config() {
         io_capability_s = "invalid";
         break;
     }
+    char mac_s[18];
+    format_mac_addr_upper(mac_address, mac_s);
     ESP_LOGCONFIG(TAG,
                   "BLE:\n"
                   "  MAC address: %s\n"
                   "  IO Capability: %s",
-                  format_mac_address_pretty(mac_address).c_str(), io_capability_s);
+                  mac_s, io_capability_s);
   } else {
     ESP_LOGCONFIG(TAG, "Bluetooth stack is not enabled");
   }

esphome/components/esp32_ble_tracker/automation.h

@@ -10,7 +10,7 @@ namespace esphome::esp32_ble_tracker {
 class ESPBTAdvertiseTrigger : public Trigger<const ESPBTDevice &>, public ESPBTDeviceListener {
  public:
   explicit ESPBTAdvertiseTrigger(ESP32BLETracker *parent) { parent->register_listener(this); }
-  void set_addresses(const std::vector<uint64_t> &addresses) { this->address_vec_ = addresses; }
+  void set_addresses(std::initializer_list<uint64_t> addresses) { this->address_vec_ = addresses; }
 
   bool parse_device(const ESPBTDevice &device) override {
     uint64_t u64_addr = device.address_uint64();

esphome/components/esp32_improv/esp32_improv_component.cpp

@@ -336,7 +336,7 @@ void ESP32ImprovComponent::process_incoming_data_() {
         this->connecting_sta_ = sta;
 
         wifi::global_wifi_component->set_sta(sta);
-        wifi::global_wifi_component->start_connecting(sta, false);
+        wifi::global_wifi_component->start_connecting(sta);
         this->set_state_(improv::STATE_PROVISIONING);
         ESP_LOGD(TAG, "Received Improv Wi-Fi settings ssid=%s, password=" LOG_SECRET("%s"), command.ssid.c_str(),
                  command.password.c_str());

esphome/components/improv_serial/improv_serial_component.cpp

@@ -231,7 +231,7 @@ bool ImprovSerialComponent::parse_improv_payload_(improv::ImprovCommand &command
       this->connecting_sta_ = sta;
 
       wifi::global_wifi_component->set_sta(sta);
-      wifi::global_wifi_component->start_connecting(sta, false);
+      wifi::global_wifi_component->start_connecting(sta);
       this->set_state_(improv::STATE_PROVISIONING);
       ESP_LOGD(TAG, "Received settings: SSID=%s, password=" LOG_SECRET("%s"), command.ssid.c_str(),
                command.password.c_str());

esphome/components/ld2450/ld2450.cpp

@@ -181,6 +181,17 @@ static inline bool validate_header_footer(const uint8_t *header_footer, const ui
   return std::memcmp(header_footer, buffer, HEADER_FOOTER_SIZE) == 0;
 }
 
+// Helper function to calculate direction based on speed
+static inline Direction calculate_direction(int16_t speed) {
+  if (speed > 0) {
+    return DIRECTION_MOVING_AWAY;
+  }
+  if (speed < 0) {
+    return DIRECTION_APPROACHING;
+  }
+  return DIRECTION_STATIONARY;
+}
+
 void LD2450Component::setup() {
 #ifdef USE_NUMBER
   if (this->presence_timeout_number_ != nullptr) {
@@ -293,6 +304,51 @@ uint8_t LD2450Component::count_targets_in_zone_(const Zone &zone, bool is_moving
   return count;
 }
 
+// Store target info for zone target counting
+void LD2450Component::set_target_info_(uint8_t index, int16_t x, int16_t y, bool is_moving) {
+  this->target_info_[index].x = x;
+  this->target_info_[index].y = y;
+  this->target_info_[index].is_moving = is_moving;
+}
+
+#ifdef USE_TEXT_SENSOR
+// Publish direction text sensor with deduplication
+void LD2450Component::publish_direction_(uint8_t index, Direction direction) {
+  text_sensor::TextSensor *sensor = this->direction_text_sensors_[index];
+  if (sensor == nullptr) {
+    return;
+  }
+  const auto *dir_str = find_str(ld2450::DIRECTION_BY_UINT, direction);
+  if (!sensor->has_state() || sensor->get_state() != dir_str) {
+    sensor->publish_state(dir_str);
+  }
+}
+#endif
+
+#ifdef USE_SENSOR
+// Publish all target sensor values with deduplication
+void LD2450Component::publish_target_sensors_(uint8_t index, int16_t x, int16_t y, uint16_t resolution, int16_t speed,
+                                              uint16_t distance, float angle) {
+  SAFE_PUBLISH_SENSOR(this->move_x_sensors_[index], x);
+  SAFE_PUBLISH_SENSOR(this->move_y_sensors_[index], y);
+  SAFE_PUBLISH_SENSOR(this->move_resolution_sensors_[index], resolution);
+  SAFE_PUBLISH_SENSOR(this->move_speed_sensors_[index], speed);
+  SAFE_PUBLISH_SENSOR(this->move_distance_sensors_[index], distance);
+  SAFE_PUBLISH_SENSOR(this->move_angle_sensors_[index], angle);
+}
+
+// Force clear all target sensor values to 0, bypassing throttle but still using deduplication
+void LD2450Component::force_clear_target_sensors_(uint8_t index) {
+  // Use publish_state() to bypass throttle filters, with manual dedup check
+  SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(this->move_x_sensors_[index], 0);
+  SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(this->move_y_sensors_[index], 0);
+  SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(this->move_resolution_sensors_[index], 0);
+  SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(this->move_speed_sensors_[index], 0);
+  SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(this->move_distance_sensors_[index], 0);
+  SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(this->move_angle_sensors_[index], 0);
+}
+#endif
+
 // Service reset_radar_zone
 void LD2450Component::reset_radar_zone() {
   this->zone_type_ = 0;
@@ -444,13 +500,13 @@ void LD2450Component::handle_periodic_data_() {
   int16_t target_count = 0;
   int16_t still_target_count = 0;
   int16_t moving_target_count = 0;
-  int16_t res = 0;
-  int16_t start = 0;
-  int16_t tx = 0;
-  int16_t ty = 0;
-  int16_t td = 0;
-  int16_t ts = 0;
-  int16_t angle = 0;
+  int16_t res = 0;    // Target resolution in mm
+  int16_t start = 0;  // Buffer offset for current data field
+  int16_t tx = 0;     // Target X coordinate in mm
+  int16_t ty = 0;     // Target Y coordinate in mm
+  int16_t td = 0;     // Target distance in mm (calculated from tx and ty)
+  int16_t ts = 0;     // Target speed in mm/s
+  int16_t angle = 0;  // Target angle in degrees
   uint8_t index = 0;
   Direction direction{DIRECTION_UNDEFINED};
   bool is_moving = false;
@@ -464,15 +520,12 @@ void LD2450Component::handle_periodic_data_() {
     is_moving = false;
     // tx is used for further calculations, so always needs to be populated
     tx = ld2450::decode_coordinate(this->buffer_data_[start], this->buffer_data_[start + 1]);
-    SAFE_PUBLISH_SENSOR(this->move_x_sensors_[index], tx);
     // Y
     start = TARGET_Y + index * 8;
     ty = ld2450::decode_coordinate(this->buffer_data_[start], this->buffer_data_[start + 1]);
-    SAFE_PUBLISH_SENSOR(this->move_y_sensors_[index], ty);
     // RESOLUTION
     start = TARGET_RESOLUTION + index * 8;
     res = (this->buffer_data_[start + 1] << 8) | this->buffer_data_[start];
-    SAFE_PUBLISH_SENSOR(this->move_resolution_sensors_[index], res);
 #endif
     // SPEED
     start = TARGET_SPEED + index * 8;
@@ -481,48 +534,43 @@ void LD2450Component::handle_periodic_data_() {
       is_moving = true;
       moving_target_count++;
     }
-#ifdef USE_SENSOR
-    SAFE_PUBLISH_SENSOR(this->move_speed_sensors_[index], ts);
-#endif
-    // DISTANCE
+    // DISTANCE (td = target distance in mm, calculated from X and Y coordinates)
     // Optimized: use already decoded tx and ty values, replace pow() with multiplication
     int32_t x_squared = (int32_t) tx * tx;
     int32_t y_squared = (int32_t) ty * ty;
-    td = (uint16_t) sqrtf(x_squared + y_squared);
-    if (td > 0) {
+    td = (uint16_t) sqrtf(x_squared + y_squared);  // Pythagorean theorem: distance = sqrt(x² + y²)
+
+    // Only publish sensor values when a target is actually detected (resolution > 0)
+    // The radar sets resolution=0 when no target is present, even if X/Y coordinates
+    // haven't been cleared from the buffer yet. This prevents stale/ghost readings.
+    if (res > 0) {
       target_count++;
-    }
 #ifdef USE_SENSOR
-    SAFE_PUBLISH_SENSOR(this->move_distance_sensors_[index], td);
-    // ANGLE
-    angle = ld2450::calculate_angle(static_cast<float>(ty), static_cast<float>(td));
-    if (tx > 0) {
-      angle = angle * -1;
-    }
-    SAFE_PUBLISH_SENSOR(this->move_angle_sensors_[index], angle);
+      // ANGLE
+      angle = ld2450::calculate_angle(static_cast<float>(ty), static_cast<float>(td));
+      if (tx > 0) {
+        angle = angle * -1;
+      }
+      this->publish_target_sensors_(index, tx, ty, res, ts, td, angle);
 #endif
 #ifdef USE_TEXT_SENSOR
-    // DIRECTION
-    if (td == 0) {
-      direction = DIRECTION_NA;
-    } else if (ts > 0) {
-      direction = DIRECTION_MOVING_AWAY;
-    } else if (ts < 0) {
-      direction = DIRECTION_APPROACHING;
-    } else {
-      direction = DIRECTION_STATIONARY;
-    }
-    text_sensor::TextSensor *tsd = this->direction_text_sensors_[index];
-    const auto *dir_str = find_str(ld2450::DIRECTION_BY_UINT, direction);
-    if (tsd != nullptr && (!tsd->has_state() || tsd->get_state() != dir_str)) {
-      tsd->publish_state(dir_str);
-    }
+      // DIRECTION
+      this->publish_direction_(index, calculate_direction(ts));
 #endif
-
-    // Store target info for zone target count
-    this->target_info_[index].x = tx;
-    this->target_info_[index].y = ty;
-    this->target_info_[index].is_moving = is_moving;
+      // Store target info for zone target count
+      this->set_target_info_(index, tx, ty, is_moving);
+    } else {
+      // No target detected - force clear all sensor values to 0, bypassing throttle/dedup
+#ifdef USE_SENSOR
+      this->force_clear_target_sensors_(index);
+#endif
+#ifdef USE_TEXT_SENSOR
+      // Set direction to NA when no target
+      this->publish_direction_(index, DIRECTION_NA);
+#endif
+      // Clear target info
+      this->set_target_info_(index, /* x= */ 0, /* y= */ 0, /* is_moving= */ false);
+    }
 
   }  // End loop thru targets
 

esphome/components/ld2450/ld2450.h

@@ -159,6 +159,15 @@ class LD2450Component : public Component, public uart::UARTDevice {
   float restore_from_flash_();
   bool get_timeout_status_(uint32_t check_millis);
   uint8_t count_targets_in_zone_(const Zone &zone, bool is_moving);
+  void set_target_info_(uint8_t index, int16_t x, int16_t y, bool is_moving);
+#ifdef USE_SENSOR
+  void publish_target_sensors_(uint8_t index, int16_t x, int16_t y, uint16_t resolution, int16_t speed,
+                               uint16_t distance, float angle);
+  void force_clear_target_sensors_(uint8_t index);
+#endif
+#ifdef USE_TEXT_SENSOR
+  void publish_direction_(uint8_t index, Direction direction);
+#endif
 
   uint32_t presence_millis_ = 0;
   uint32_t still_presence_millis_ = 0;

esphome/components/ld24xx/ld24xx.h

@@ -33,6 +33,13 @@
     (sensor)->publish_state_unknown(); \
   }
 
+#define SAFE_PUBLISH_SENSOR_WITHOUT_FILTERS(sensor, value) \
+  if ((sensor) != nullptr && (sensor)->sens->state != static_cast<float>(value)) { \
+    (sensor)->publish_dedup.next(value); \
+    (sensor)->sens->raw_state = static_cast<float>(value); \
+    (sensor)->sens->internal_send_state_to_frontend(static_cast<float>(value)); \
+  }
+
 #define highbyte(val) (uint8_t)((val) >> 8)
 #define lowbyte(val) (uint8_t)((val) &0xff)
 

esphome/components/lvgl/__init__.py

@@ -331,7 +331,7 @@ async def to_code(configs):
     # This must be done after all widgets are created
     for comp in helpers.lvgl_components_required:
         cg.add_define(f"USE_LVGL_{comp.upper()}")
-    if "transform_angle" in styles_used:
+    if {"transform_angle", "transform_zoom"} & styles_used:
         add_define("LV_COLOR_SCREEN_TRANSP", "1")
     for use in helpers.lv_uses:
         add_define(f"LV_USE_{use.upper()}")

esphome/components/network/__init__.py

@@ -1,7 +1,9 @@
 import ipaddress
+import logging
 
 import esphome.codegen as cg
 from esphome.components.esp32 import add_idf_sdkconfig_option
+from esphome.components.psram import is_guaranteed as psram_is_guaranteed
 import esphome.config_validation as cv
 from esphome.const import CONF_ENABLE_IPV6, CONF_MIN_IPV6_ADDR_COUNT
 from esphome.core import CORE, CoroPriority, coroutine_with_priority
@@ -9,6 +11,13 @@ from esphome.core import CORE, CoroPriority, coroutine_with_priority
 CODEOWNERS = ["@esphome/core"]
 AUTO_LOAD = ["mdns"]
 
+_LOGGER = logging.getLogger(__name__)
+
+# High performance networking tracking infrastructure
+# Components can request high performance networking and this configures lwip and WiFi settings
+KEY_HIGH_PERFORMANCE_NETWORKING = "high_performance_networking"
+CONF_ENABLE_HIGH_PERFORMANCE = "enable_high_performance"
+
 network_ns = cg.esphome_ns.namespace("network")
 IPAddress = network_ns.class_("IPAddress")
 
@@ -47,6 +56,55 @@ def ip_address_literal(ip: str | int | None) -> cg.MockObj:
     return IPAddress(str(ip))
 
 
+def require_high_performance_networking() -> None:
+    """Request high performance networking for network and WiFi.
+
+    Call this from components that need optimized network performance for streaming
+    or high-throughput data transfer. This enables high performance mode which
+    configures both lwip TCP settings and WiFi driver settings for improved
+    network performance.
+
+    Settings applied (ESP-IDF only):
+    - lwip: Larger TCP buffers, windows, and mailbox sizes
+    - WiFi: Increased RX/TX buffers, AMPDU aggregation, PSRAM allocation (set by wifi component)
+
+    Configuration is PSRAM-aware:
+    - With PSRAM guaranteed: Aggressive settings (512 RX buffers, 512KB TCP windows)
+    - Without PSRAM: Conservative optimized settings (64 buffers, 65KB TCP windows)
+
+    Example:
+        from esphome.components import network
+
+        def _request_high_performance_networking(config):
+            network.require_high_performance_networking()
+            return config
+
+        CONFIG_SCHEMA = cv.All(
+            ...,
+            _request_high_performance_networking,
+        )
+    """
+    # Only set up once (idempotent - multiple components can call this)
+    if not CORE.data.get(KEY_HIGH_PERFORMANCE_NETWORKING, False):
+        CORE.data[KEY_HIGH_PERFORMANCE_NETWORKING] = True
+
+
+def has_high_performance_networking() -> bool:
+    """Check if high performance networking mode is enabled.
+
+    Returns True when high performance networking has been requested by a
+    component or explicitly enabled in the network configuration. This indicates
+    that lwip and WiFi will use optimized buffer sizes and settings.
+
+    This function should be called during code generation (to_code phase) by
+    components that need to apply performance-related settings.
+
+    Returns:
+        bool: True if high performance networking is enabled, False otherwise
+    """
+    return CORE.data.get(KEY_HIGH_PERFORMANCE_NETWORKING, False)
+
+
 CONFIG_SCHEMA = cv.Schema(
     {
         cv.SplitDefault(
@@ -71,6 +129,7 @@ CONFIG_SCHEMA = cv.Schema(
             ),
         ),
         cv.Optional(CONF_MIN_IPV6_ADDR_COUNT, default=0): cv.positive_int,
+        cv.Optional(CONF_ENABLE_HIGH_PERFORMANCE): cv.All(cv.boolean, cv.only_on_esp32),
     }
 )
 
@@ -80,6 +139,70 @@ async def to_code(config):
     cg.add_define("USE_NETWORK")
     if CORE.using_arduino and CORE.is_esp32:
         cg.add_library("Networking", None)
+
+    # Apply high performance networking settings
+    # Config can explicitly enable/disable, or default to component-driven behavior
+    enable_high_perf = config.get(CONF_ENABLE_HIGH_PERFORMANCE)
+    component_requested = CORE.data.get(KEY_HIGH_PERFORMANCE_NETWORKING, False)
+
+    # Explicit config overrides component request
+    should_enable = (
+        enable_high_perf if enable_high_perf is not None else component_requested
+    )
+
+    # Log when user explicitly disables but a component requested it
+    if enable_high_perf is False and component_requested:
+        _LOGGER.info(
+            "High performance networking disabled by user configuration (overriding component request)"
+        )
+
+    if CORE.is_esp32 and CORE.using_esp_idf and should_enable:
+        # Check if PSRAM is guaranteed (set by psram component during final validation)
+        psram_guaranteed = psram_is_guaranteed()
+
+        if psram_guaranteed:
+            _LOGGER.info(
+                "Applying high-performance lwip settings (PSRAM guaranteed): 512KB TCP windows, 512 mailbox sizes"
+            )
+            # PSRAM is guaranteed - use aggressive settings
+            # Higher maximum values are allowed because CONFIG_LWIP_WND_SCALE is set to true
+            # CONFIG_LWIP_WND_SCALE can only be enabled if CONFIG_SPIRAM_IGNORE_NOTFOUND isn't set
+            # Based on https://github.com/espressif/esp-adf/issues/297#issuecomment-783811702
+
+            # Enable window scaling for much larger TCP windows
+            add_idf_sdkconfig_option("CONFIG_LWIP_WND_SCALE", True)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_RCV_SCALE", 3)
+
+            # Large TCP buffers and windows (requires PSRAM)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_SND_BUF_DEFAULT", 65534)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_WND_DEFAULT", 512000)
+
+            # Large mailboxes for high throughput
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCPIP_RECVMBOX_SIZE", 512)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_RECVMBOX_SIZE", 512)
+
+            # TCP connection limits
+            add_idf_sdkconfig_option("CONFIG_LWIP_MAX_ACTIVE_TCP", 16)
+            add_idf_sdkconfig_option("CONFIG_LWIP_MAX_LISTENING_TCP", 16)
+
+            # TCP optimizations
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_MAXRTX", 12)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_SYNMAXRTX", 6)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_MSS", 1436)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_MSL", 60000)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_OVERSIZE_MSS", True)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_QUEUE_OOSEQ", True)
+        else:
+            _LOGGER.info(
+                "Applying optimized lwip settings: 65KB TCP windows, 64 mailbox sizes"
+            )
+            # PSRAM not guaranteed - use more conservative, but still optimized settings
+            # Based on https://github.com/espressif/esp-idf/blob/release/v5.4/examples/wifi/iperf/sdkconfig.defaults.esp32
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_SND_BUF_DEFAULT", 65534)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_WND_DEFAULT", 65534)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCP_RECVMBOX_SIZE", 64)
+            add_idf_sdkconfig_option("CONFIG_LWIP_TCPIP_RECVMBOX_SIZE", 64)
+
     if (enable_ipv6 := config.get(CONF_ENABLE_IPV6, None)) is not None:
         cg.add_define("USE_NETWORK_IPV6", enable_ipv6)
         if enable_ipv6:

esphome/components/network/ip_address.h

@@ -118,10 +118,10 @@ struct IPAddress {
   operator arduino_ns::IPAddress() const { return ip_addr_get_ip4_u32(&ip_addr_); }
 #endif
 
-  bool is_set() { return !ip_addr_isany(&ip_addr_); }  // NOLINT(readability-simplify-boolean-expr)
-  bool is_ip4() { return IP_IS_V4(&ip_addr_); }
-  bool is_ip6() { return IP_IS_V6(&ip_addr_); }
-  bool is_multicast() { return ip_addr_ismulticast(&ip_addr_); }
+  bool is_set() const { return !ip_addr_isany(&ip_addr_); }  // NOLINT(readability-simplify-boolean-expr)
+  bool is_ip4() const { return IP_IS_V4(&ip_addr_); }
+  bool is_ip6() const { return IP_IS_V6(&ip_addr_); }
+  bool is_multicast() const { return ip_addr_ismulticast(&ip_addr_); }
   std::string str() const { return str_lower_case(ipaddr_ntoa(&ip_addr_)); }
   bool operator==(const IPAddress &other) const { return ip_addr_cmp(&ip_addr_, &other.ip_addr_); }
   bool operator!=(const IPAddress &other) const { return !ip_addr_cmp(&ip_addr_, &other.ip_addr_); }

esphome/components/nrf52/__init__.py

@@ -107,7 +107,6 @@ CONF_REG0 = "reg0"
 CONF_UICR_ERASE = "uicr_erase"
 
 VOLTAGE_LEVELS = [1.8, 2.1, 2.4, 2.7, 3.0, 3.3]
-DEFAULT_VOLTAGE_LEVEL = "default"
 
 CONFIG_SCHEMA = cv.All(
     _detect_bootloader,
@@ -124,12 +123,9 @@ CONFIG_SCHEMA = cv.All(
             ),
             cv.Optional(CONF_REG0): cv.Schema(
                 {
-                    cv.Required(CONF_VOLTAGE): cv.Any(
-                        cv.All(
-                            cv.voltage,
-                            cv.one_of(*VOLTAGE_LEVELS, float=True),
-                        ),
-                        cv.one_of(*[DEFAULT_VOLTAGE_LEVEL], lower=True),
+                    cv.Required(CONF_VOLTAGE): cv.All(
+                        cv.voltage,
+                        cv.one_of(*VOLTAGE_LEVELS, float=True),
                     ),
                     cv.Optional(CONF_UICR_ERASE, default=False): cv.boolean,
                 }
@@ -202,9 +198,7 @@ async def to_code(config: ConfigType) -> None:
         CORE.add_job(_dfu_to_code, dfu_config)
 
     if reg0_config := config.get(CONF_REG0):
-        value = 7  # DEFAULT_VOLTAGE_LEVEL
-        if reg0_config[CONF_VOLTAGE] in VOLTAGE_LEVELS:
-            value = VOLTAGE_LEVELS.index(reg0_config[CONF_VOLTAGE])
+        value = VOLTAGE_LEVELS.index(reg0_config[CONF_VOLTAGE])
         cg.add_define("USE_NRF52_REG0_VOUT", value)
         if reg0_config[CONF_UICR_ERASE]:
             cg.add_define("USE_NRF52_UICR_ERASE")

esphome/components/nrf52/uicr.cpp

@@ -69,9 +69,20 @@ static StatusFlags fix_bootloader() {
 }
 #endif
 
+#define BOOTLOADER_VERSION_REGISTER NRF_TIMER2->CC[0]
+
 static StatusFlags set_uicr() {
   StatusFlags status = StatusFlags::OK;
-  status |= set_regout0();
+#ifndef USE_BOOTLOADER_MCUBOOT
+  if (BOOTLOADER_VERSION_REGISTER <= 0x902) {
+#ifdef CONFIG_PRINTK
+    printk("cannot control regout0 for %#x\n", BOOTLOADER_VERSION_REGISTER);
+#endif
+  } else
+#endif
+  {
+    status |= set_regout0();
+  }
 #ifndef USE_BOOTLOADER_MCUBOOT
   status |= fix_bootloader();
 #endif

esphome/components/psram/__init__.py

@@ -35,6 +35,9 @@ DOMAIN = "psram"
 
 DEPENDENCIES = [PLATFORM_ESP32]
 
+# PSRAM availability tracking for cross-component coordination
+KEY_PSRAM_GUARANTEED = "psram_guaranteed"
+
 _LOGGER = logging.getLogger(__name__)
 
 psram_ns = cg.esphome_ns.namespace(DOMAIN)
@@ -71,6 +74,23 @@ def supported() -> bool:
     return variant in SPIRAM_MODES
 
 
+def is_guaranteed() -> bool:
+    """Check if PSRAM is guaranteed to be available.
+
+    Returns True when PSRAM is configured with both 'disabled: false' and
+    'ignore_not_found: false', meaning the device will fail to boot if PSRAM
+    is not found. This ensures safe use of high buffer configurations that
+    depend on PSRAM.
+
+    This function should be called during code generation (to_code phase) by
+    components that need to know PSRAM availability for configuration decisions.
+
+    Returns:
+        bool: True if PSRAM is guaranteed, False otherwise
+    """
+    return CORE.data.get(KEY_PSRAM_GUARANTEED, False)
+
+
 def validate_psram_mode(config):
     esp32_config = fv.full_config.get()[PLATFORM_ESP32]
     if config[CONF_SPEED] == "120MHZ":
@@ -131,7 +151,22 @@ def get_config_schema(config):
 
 CONFIG_SCHEMA = get_config_schema
 
-FINAL_VALIDATE_SCHEMA = validate_psram_mode
+
+def _store_psram_guaranteed(config):
+    """Store PSRAM guaranteed status in CORE.data for other components.
+
+    PSRAM is "guaranteed" when it will fail if not found, ensuring safe use
+    of high buffer configurations in network/wifi components.
+
+    Called during final validation to ensure the flag is available
+    before any to_code() functions run.
+    """
+    psram_guaranteed = not config[CONF_DISABLED] and not config[CONF_IGNORE_NOT_FOUND]
+    CORE.data[KEY_PSRAM_GUARANTEED] = psram_guaranteed
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = cv.All(validate_psram_mode, _store_psram_guaranteed)
 
 
 async def to_code(config):

esphome/components/speaker/media_player/__init__.py

@@ -6,7 +6,7 @@ from pathlib import Path
 
 from esphome import automation, external_files
 import esphome.codegen as cg
-from esphome.components import audio, esp32, media_player, psram, speaker
+from esphome.components import audio, esp32, media_player, network, psram, speaker
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_BUFFER_SIZE,
@@ -32,6 +32,7 @@ _LOGGER = logging.getLogger(__name__)
 
 
 AUTO_LOAD = ["audio"]
+DEPENDENCIES = ["network"]
 
 CODEOWNERS = ["@kahrendt", "@synesthesiam"]
 DOMAIN = "media_player"
@@ -280,6 +281,18 @@ PIPELINE_SCHEMA = cv.Schema(
     }
 )
 
+
+def _request_high_performance_networking(config):
+    """Request high performance networking for streaming media.
+
+    Speaker media player streams audio data, so it always benefits from
+    optimized WiFi and lwip settings regardless of codec support.
+    Called during config validation to ensure flags are set before to_code().
+    """
+    network.require_high_performance_networking()
+    return config
+
+
 CONFIG_SCHEMA = cv.All(
     media_player.media_player_schema(SpeakerMediaPlayer).extend(
         {
@@ -304,6 +317,7 @@ CONFIG_SCHEMA = cv.All(
     ),
     cv.only_with_esp_idf,
     _validate_repeated_speaker,
+    _request_high_performance_networking,
 )
 
 
@@ -321,28 +335,10 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 
 async def to_code(config):
     if CORE.data[DOMAIN][config[CONF_ID].id][CONF_CODEC_SUPPORT_ENABLED]:
-        # Compile all supported audio codecs and optimize the wifi settings
-
+        # Compile all supported audio codecs
         cg.add_define("USE_AUDIO_FLAC_SUPPORT", True)
         cg.add_define("USE_AUDIO_MP3_SUPPORT", True)
 
-        # Based on https://github.com/espressif/esp-idf/blob/release/v5.4/examples/wifi/iperf/sdkconfig.defaults.esp32
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_STATIC_RX_BUFFER_NUM", 16)
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_DYNAMIC_RX_BUFFER_NUM", 64)
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_DYNAMIC_TX_BUFFER_NUM", 64)
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_TX_ENABLED", True)
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_TX_BA_WIN", 32)
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_RX_ENABLED", True)
-        esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_RX_BA_WIN", 32)
-
-        esp32.add_idf_sdkconfig_option("CONFIG_LWIP_TCP_SND_BUF_DEFAULT", 65534)
-        esp32.add_idf_sdkconfig_option("CONFIG_LWIP_TCP_WND_DEFAULT", 65534)
-        esp32.add_idf_sdkconfig_option("CONFIG_LWIP_TCP_RECVMBOX_SIZE", 64)
-        esp32.add_idf_sdkconfig_option("CONFIG_LWIP_TCPIP_RECVMBOX_SIZE", 64)
-
-        # Allocate wifi buffers in PSRAM
-        esp32.add_idf_sdkconfig_option("CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP", True)
-
     var = await media_player.new_media_player(config)
     await cg.register_component(var, config)
 

esphome/components/wifi/__init__.py

@@ -1,9 +1,15 @@
+import logging
+
 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
 from esphome.components.const import CONF_USE_PSRAM
 from esphome.components.esp32 import add_idf_sdkconfig_option, const, get_esp32_variant
-from esphome.components.network import ip_address_literal
+from esphome.components.network import (
+    has_high_performance_networking,
+    ip_address_literal,
+)
+from esphome.components.psram import is_guaranteed as psram_is_guaranteed
 from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
 from esphome.config_validation import only_with_esp_idf
@@ -42,6 +48,7 @@ from esphome.const import (
     CONF_TTLS_PHASE_2,
     CONF_USE_ADDRESS,
     CONF_USERNAME,
+    Platform,
     PlatformFramework,
 )
 from esphome.core import CORE, CoroPriority, HexInt, coroutine_with_priority
@@ -49,10 +56,15 @@ import esphome.final_validate as fv
 
 from . import wpa2_eap
 
+_LOGGER = logging.getLogger(__name__)
+
 AUTO_LOAD = ["network"]
 
+_LOGGER = logging.getLogger(__name__)
+
 NO_WIFI_VARIANTS = [const.VARIANT_ESP32H2, const.VARIANT_ESP32P4]
 CONF_SAVE = "save"
+CONF_MIN_AUTH_MODE = "min_auth_mode"
 
 # Maximum number of WiFi networks that can be configured
 # Limited to 127 because selected_sta_index_ is int8_t in C++
@@ -70,6 +82,14 @@ WIFI_POWER_SAVE_MODES = {
     "LIGHT": WiFiPowerSaveMode.WIFI_POWER_SAVE_LIGHT,
     "HIGH": WiFiPowerSaveMode.WIFI_POWER_SAVE_HIGH,
 }
+
+WifiMinAuthMode = wifi_ns.enum("WifiMinAuthMode")
+WIFI_MIN_AUTH_MODES = {
+    "WPA": WifiMinAuthMode.WIFI_MIN_AUTH_MODE_WPA,
+    "WPA2": WifiMinAuthMode.WIFI_MIN_AUTH_MODE_WPA2,
+    "WPA3": WifiMinAuthMode.WIFI_MIN_AUTH_MODE_WPA3,
+}
+VALIDATE_WIFI_MIN_AUTH_MODE = cv.enum(WIFI_MIN_AUTH_MODES, upper=True)
 WiFiConnectedCondition = wifi_ns.class_("WiFiConnectedCondition", Condition)
 WiFiEnabledCondition = wifi_ns.class_("WiFiEnabledCondition", Condition)
 WiFiEnableAction = wifi_ns.class_("WiFiEnableAction", automation.Action)
@@ -174,7 +194,7 @@ WIFI_NETWORK_STA = WIFI_NETWORK_BASE.extend(
     {
         cv.Optional(CONF_BSSID): cv.mac_address,
         cv.Optional(CONF_HIDDEN): cv.boolean,
-        cv.Optional(CONF_PRIORITY, default=0.0): cv.float_,
+        cv.Optional(CONF_PRIORITY, default=0): cv.int_range(min=-128, max=127),
         cv.Optional(CONF_EAP): EAP_AUTH_SCHEMA,
     }
 )
@@ -187,6 +207,27 @@ def validate_variant(_):
             raise cv.Invalid(f"WiFi requires component esp32_hosted on {variant}")
 
 
+def _apply_min_auth_mode_default(config):
+    """Apply platform-specific default for min_auth_mode and warn ESP8266 users."""
+    # Only apply defaults for platforms that support min_auth_mode
+    if CONF_MIN_AUTH_MODE not in config and (CORE.is_esp8266 or CORE.is_esp32):
+        if CORE.is_esp8266:
+            _LOGGER.warning(
+                "The minimum WiFi authentication mode (wifi -> min_auth_mode) is not set. "
+                "This controls the weakest encryption your device will accept when connecting to WiFi. "
+                "Currently defaults to WPA (less secure), but will change to WPA2 (more secure) in 2026.6.0. "
+                "WPA uses TKIP encryption which has known security vulnerabilities and should be avoided. "
+                "WPA2 uses AES encryption which is significantly more secure. "
+                "To silence this warning, explicitly set min_auth_mode under 'wifi:'. "
+                "If your router supports WPA2 or WPA3, set 'min_auth_mode: WPA2'. "
+                "If your router only supports WPA, set 'min_auth_mode: WPA'."
+            )
+            config[CONF_MIN_AUTH_MODE] = VALIDATE_WIFI_MIN_AUTH_MODE("WPA")
+        elif CORE.is_esp32:
+            config[CONF_MIN_AUTH_MODE] = VALIDATE_WIFI_MIN_AUTH_MODE("WPA2")
+    return config
+
+
 def final_validate(config):
     has_sta = bool(config.get(CONF_NETWORKS, True))
     has_ap = CONF_AP in config
@@ -287,6 +328,10 @@ CONFIG_SCHEMA = cv.All(
             ): cv.enum(WIFI_POWER_SAVE_MODES, upper=True),
             cv.Optional(CONF_FAST_CONNECT, default=False): cv.boolean,
             cv.Optional(CONF_USE_ADDRESS): cv.string_strict,
+            cv.Optional(CONF_MIN_AUTH_MODE): cv.All(
+                VALIDATE_WIFI_MIN_AUTH_MODE,
+                cv.only_on([Platform.ESP32, Platform.ESP8266]),
+            ),
             cv.SplitDefault(CONF_OUTPUT_POWER, esp8266=20.0): cv.All(
                 cv.decibel, cv.float_range(min=8.5, max=20.5)
             ),
@@ -311,6 +356,7 @@ CONFIG_SCHEMA = cv.All(
             ),
         }
     ),
+    _apply_min_auth_mode_default,
     _validate,
 )
 
@@ -385,6 +431,8 @@ async def to_code(config):
 
     # Track if any network uses Enterprise authentication
     has_eap = False
+    # Track if any network uses manual IP
+    has_manual_ip = False
 
     # Initialize FixedVector with the count of networks
     networks = config.get(CONF_NETWORKS, [])
@@ -398,11 +446,15 @@ async def to_code(config):
         for network in networks:
             if CONF_EAP in network:
                 has_eap = True
+            if network.get(CONF_MANUAL_IP) or config.get(CONF_MANUAL_IP):
+                has_manual_ip = True
             cg.with_local_variable(network[CONF_ID], WiFiAP(), add_sta, network)
 
     if CONF_AP in config:
         conf = config[CONF_AP]
         ip_config = conf.get(CONF_MANUAL_IP)
+        if ip_config:
+            has_manual_ip = True
         cg.with_local_variable(
             conf[CONF_ID],
             WiFiAP(),
@@ -418,8 +470,14 @@ async def to_code(config):
     if CORE.is_esp32:
         add_idf_sdkconfig_option("CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT", has_eap)
 
+    # Only define USE_WIFI_MANUAL_IP if any AP uses manual IP
+    if has_manual_ip:
+        cg.add_define("USE_WIFI_MANUAL_IP")
+
     cg.add(var.set_reboot_timeout(config[CONF_REBOOT_TIMEOUT]))
     cg.add(var.set_power_save_mode(config[CONF_POWER_SAVE_MODE]))
+    if CONF_MIN_AUTH_MODE in config:
+        cg.add(var.set_min_auth_mode(config[CONF_MIN_AUTH_MODE]))
     if config[CONF_FAST_CONNECT]:
         cg.add_define("USE_WIFI_FAST_CONNECT")
     cg.add(var.set_passive_scan(config[CONF_PASSIVE_SCAN]))
@@ -444,6 +502,56 @@ async def to_code(config):
 
     if config.get(CONF_USE_PSRAM):
         add_idf_sdkconfig_option("CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP", True)
+
+    # Apply high performance WiFi settings if high performance networking is enabled
+    if CORE.is_esp32 and CORE.using_esp_idf and has_high_performance_networking():
+        # Check if PSRAM is guaranteed (set by psram component during final validation)
+        psram_guaranteed = psram_is_guaranteed()
+
+        # Always allocate WiFi buffers in PSRAM if available
+        add_idf_sdkconfig_option("CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP", True)
+
+        if psram_guaranteed:
+            _LOGGER.info(
+                "Applying high-performance WiFi settings (PSRAM guaranteed): 512 RX buffers, 32 TX buffers"
+            )
+            # PSRAM is guaranteed - use aggressive settings
+            # Higher maximum values are allowed because CONFIG_LWIP_WND_SCALE is set to true in networking component
+            # Based on https://github.com/espressif/esp-adf/issues/297#issuecomment-783811702
+
+            # Large dynamic RX buffers (requires PSRAM)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_STATIC_RX_BUFFER_NUM", 16)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_DYNAMIC_RX_BUFFER_NUM", 512)
+
+            # Static TX buffers for better performance
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_STATIC_TX_BUFFER", True)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_TX_BUFFER_TYPE", 0)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_CACHE_TX_BUFFER_NUM", 32)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_STATIC_TX_BUFFER_NUM", 8)
+
+            # AMPDU settings optimized for PSRAM
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_TX_ENABLED", True)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_TX_BA_WIN", 16)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_RX_ENABLED", True)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_RX_BA_WIN", 32)
+        else:
+            _LOGGER.info(
+                "Applying optimized WiFi settings: 64 RX buffers, 64 TX buffers"
+            )
+            # PSRAM not guaranteed - use more conservative, but still optimized settings
+            # Based on https://github.com/espressif/esp-idf/blob/release/v5.4/examples/wifi/iperf/sdkconfig.defaults.esp32
+
+            # Standard buffer counts
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_STATIC_RX_BUFFER_NUM", 16)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_DYNAMIC_RX_BUFFER_NUM", 64)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_DYNAMIC_TX_BUFFER_NUM", 64)
+
+            # Standard AMPDU settings
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_TX_ENABLED", True)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_TX_BA_WIN", 32)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_RX_ENABLED", True)
+            add_idf_sdkconfig_option("CONFIG_ESP_WIFI_RX_BA_WIN", 32)
+
     cg.add_define("USE_WIFI")
 
     # must register before OTA safe mode check

esphome/components/wifi/wifi_component.cpp

@@ -197,6 +197,10 @@ static constexpr uint8_t WIFI_RETRY_COUNT_PER_SSID = 1;
 // Rationale: Fast connect prioritizes speed - try each AP once to find a working one quickly
 static constexpr uint8_t WIFI_RETRY_COUNT_PER_AP = 1;
 
+/// Cooldown duration in milliseconds after adapter restart or repeated failures
+/// Allows WiFi hardware to stabilize before next connection attempt
+static constexpr uint32_t WIFI_COOLDOWN_DURATION_MS = 1000;
+
 static constexpr uint8_t get_max_retries_for_phase(WiFiRetryPhase phase) {
   switch (phase) {
     case WiFiRetryPhase::INITIAL_CONNECT:
@@ -253,17 +257,19 @@ bool WiFiComponent::ssid_was_seen_in_scan_(const std::string &ssid) const {
   return false;
 }
 
-int8_t WiFiComponent::find_next_hidden_sta_(int8_t start_index, bool include_explicit_hidden) {
+int8_t WiFiComponent::find_next_hidden_sta_(int8_t start_index) {
   // Find next SSID that wasn't in scan results (might be hidden)
+  bool include_explicit_hidden = !this->went_through_explicit_hidden_phase_();
   // Start searching from start_index + 1
   for (size_t i = start_index + 1; i < this->sta_.size(); i++) {
     const auto &sta = this->sta_[i];
 
     // Skip networks that were already tried in EXPLICIT_HIDDEN phase
     // Those are: networks marked hidden:true that appear before the first non-hidden network
+    // If all networks are hidden (first_non_hidden_idx == -1), skip all of them
     if (!include_explicit_hidden && sta.get_hidden()) {
       int8_t first_non_hidden_idx = this->find_first_non_hidden_index_();
-      if (first_non_hidden_idx >= 0 && static_cast<int8_t>(i) < first_non_hidden_idx) {
+      if (first_non_hidden_idx < 0 || static_cast<int8_t>(i) < first_non_hidden_idx) {
         ESP_LOGD(TAG, "Skipping " LOG_SECRET("'%s'") " (explicit hidden, already tried)", sta.get_ssid().c_str());
         continue;
       }
@@ -273,7 +279,7 @@ int8_t WiFiComponent::find_next_hidden_sta_(int8_t start_index, bool include_exp
       ESP_LOGD(TAG, "Hidden candidate " LOG_SECRET("'%s'") " at index %d", sta.get_ssid().c_str(), static_cast<int>(i));
       return static_cast<int8_t>(i);
     }
-    ESP_LOGD(TAG, "Skipping " LOG_SECRET("'%s'") " (visible in scan)", sta.get_ssid().c_str());
+    ESP_LOGD(TAG, "Skipping hidden retry for visible network " LOG_SECRET("'%s'"), sta.get_ssid().c_str());
   }
   // No hidden SSIDs found
   return -1;
@@ -287,7 +293,7 @@ void WiFiComponent::start_initial_connection_() {
     this->selected_sta_index_ = 0;
     this->retry_phase_ = WiFiRetryPhase::EXPLICIT_HIDDEN;
     WiFiAP params = this->build_params_for_current_phase_();
-    this->start_connecting(params, false);
+    this->start_connecting(params);
   } else {
     ESP_LOGI(TAG, "Starting scan");
     this->start_scanning();
@@ -369,13 +375,13 @@ void WiFiComponent::start() {
     // Without saved data, try first configured network or use normal flow
     if (loaded_fast_connect) {
       ESP_LOGI(TAG, "Starting fast_connect (saved) " LOG_SECRET("'%s'"), params.get_ssid().c_str());
-      this->start_connecting(params, false);
+      this->start_connecting(params);
     } else if (!this->sta_.empty() && !this->sta_[0].get_hidden()) {
       // No saved data, but have configured networks - try first non-hidden network
       ESP_LOGI(TAG, "Starting fast_connect (config) " LOG_SECRET("'%s'"), this->sta_[0].get_ssid().c_str());
       this->selected_sta_index_ = 0;
       params = this->build_params_for_current_phase_();
-      this->start_connecting(params, false);
+      this->start_connecting(params);
     } else {
       // No saved data and (no networks OR first is hidden) - use normal flow
       this->start_initial_connection_();
@@ -411,8 +417,11 @@ void WiFiComponent::start() {
 void WiFiComponent::restart_adapter() {
   ESP_LOGW(TAG, "Restarting adapter");
   this->wifi_mode_(false, {});
-  delay(100);  // NOLINT
+  // Enter cooldown state to allow WiFi hardware to stabilize after restart
   // Don't set retry_phase_ or num_retried_ here - state machine handles transitions
+  this->state_ = WIFI_COMPONENT_STATE_COOLDOWN;
+  this->action_started_ = millis();
+  this->error_from_callback_ = false;
 }
 
 void WiFiComponent::loop() {
@@ -432,20 +441,12 @@ void WiFiComponent::loop() {
     switch (this->state_) {
       case WIFI_COMPONENT_STATE_COOLDOWN: {
         this->status_set_warning(LOG_STR("waiting to reconnect"));
-        if (millis() - this->action_started_ > 5000) {
-          // After cooldown, connect based on current retry phase
-          this->reset_selected_ap_to_first_if_invalid_();
-
-          // Check if we need to trigger a scan first
-          if (this->needs_scan_results_() && !this->all_networks_hidden_()) {
-            // Need scan results or no matching networks found - scan/rescan
-            ESP_LOGD(TAG, "Scanning required for phase %s", LOG_STR_ARG(retry_phase_to_log_string(this->retry_phase_)));
-            this->start_scanning();
-          } else {
-            // Have everything we need to connect (or all networks are hidden, skip scanning)
-            WiFiAP params = this->build_params_for_current_phase_();
-            this->start_connecting(params, false);
-          }
+        if (now - this->action_started_ > WIFI_COOLDOWN_DURATION_MS) {
+          // After cooldown we either restarted the adapter because of
+          // a failure, or something tried to connect over and over
+          // so we entered cooldown. In both cases we call
+          // check_connecting_finished to continue the state machine.
+          this->check_connecting_finished();
         }
         break;
       }
@@ -454,8 +455,7 @@ void WiFiComponent::loop() {
         this->check_scanning_finished();
         break;
       }
-      case WIFI_COMPONENT_STATE_STA_CONNECTING:
-      case WIFI_COMPONENT_STATE_STA_CONNECTING_2: {
+      case WIFI_COMPONENT_STATE_STA_CONNECTING: {
         this->status_set_warning(LOG_STR("associating to network"));
         this->check_connecting_finished();
         break;
@@ -569,6 +569,7 @@ void WiFiComponent::setup_ap_config_() {
                 "  IP Address: %s",
                 this->ap_.get_ssid().c_str(), this->ap_.get_password().c_str(), ip_address.c_str());
 
+#ifdef USE_WIFI_MANUAL_IP
   auto manual_ip = this->ap_.get_manual_ip();
   if (manual_ip.has_value()) {
     ESP_LOGCONFIG(TAG,
@@ -578,6 +579,7 @@ void WiFiComponent::setup_ap_config_() {
                   manual_ip->static_ip.str().c_str(), manual_ip->gateway.str().c_str(),
                   manual_ip->subnet.str().c_str());
   }
+#endif
 
   if (!this->has_sta()) {
     this->state_ = WIFI_COMPONENT_STATE_AP;
@@ -664,27 +666,27 @@ void WiFiComponent::save_wifi_sta(const std::string &ssid, const std::string &pa
   this->set_sta(sta);
 }
 
-void WiFiComponent::start_connecting(const WiFiAP &ap, bool two) {
+void WiFiComponent::start_connecting(const WiFiAP &ap) {
   // Log connection attempt at INFO level with priority
-  std::string bssid_formatted;
-  float priority = 0.0f;
+  char bssid_s[18];
+  int8_t priority = 0;
 
   if (ap.get_bssid().has_value()) {
-    bssid_formatted = format_mac_address_pretty(ap.get_bssid().value().data());
+    format_mac_addr_upper(ap.get_bssid().value().data(), bssid_s);
     priority = this->get_sta_priority(ap.get_bssid().value());
   }
 
   ESP_LOGI(TAG,
-           "Connecting to " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") " (priority %.1f, attempt %u/%u in phase %s)...",
-           ap.get_ssid().c_str(), ap.get_bssid().has_value() ? bssid_formatted.c_str() : LOG_STR_LITERAL("any"),
-           priority, this->num_retried_ + 1, get_max_retries_for_phase(this->retry_phase_),
+           "Connecting to " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") " (priority %d, attempt %u/%u in phase %s)...",
+           ap.get_ssid().c_str(), ap.get_bssid().has_value() ? bssid_s : LOG_STR_LITERAL("any"), priority,
+           this->num_retried_ + 1, get_max_retries_for_phase(this->retry_phase_),
            LOG_STR_ARG(retry_phase_to_log_string(this->retry_phase_)));
 
 #ifdef ESPHOME_LOG_HAS_VERBOSE
   ESP_LOGV(TAG, "Connection Params:");
   ESP_LOGV(TAG, "  SSID: '%s'", ap.get_ssid().c_str());
   if (ap.get_bssid().has_value()) {
-    ESP_LOGV(TAG, "  BSSID: %s", format_mac_address_pretty(ap.get_bssid()->data()).c_str());
+    ESP_LOGV(TAG, "  BSSID: %s", bssid_s);
   } else {
     ESP_LOGV(TAG, "  BSSID: Not Set");
   }
@@ -716,11 +718,14 @@ void WiFiComponent::start_connecting(const WiFiAP &ap, bool two) {
   } else {
     ESP_LOGV(TAG, "  Channel not set");
   }
+#ifdef USE_WIFI_MANUAL_IP
   if (ap.get_manual_ip().has_value()) {
     ManualIP m = *ap.get_manual_ip();
     ESP_LOGV(TAG, "  Manual IP: Static IP=%s Gateway=%s Subnet=%s DNS1=%s DNS2=%s", m.static_ip.str().c_str(),
              m.gateway.str().c_str(), m.subnet.str().c_str(), m.dns1.str().c_str(), m.dns2.str().c_str());
-  } else {
+  } else
+#endif
+  {
     ESP_LOGV(TAG, "  Using DHCP IP");
   }
   ESP_LOGV(TAG, "  Hidden: %s", YESNO(ap.get_hidden()));
@@ -728,14 +733,11 @@ void WiFiComponent::start_connecting(const WiFiAP &ap, bool two) {
 
   if (!this->wifi_sta_connect_(ap)) {
     ESP_LOGE(TAG, "wifi_sta_connect_ failed");
-    this->retry_connect();
-    return;
-  }
-
-  if (!two) {
-    this->state_ = WIFI_COMPONENT_STATE_STA_CONNECTING;
+    // Enter cooldown to allow WiFi hardware to stabilize
+    // (immediate failure suggests hardware not ready, different from connection timeout)
+    this->state_ = WIFI_COMPONENT_STATE_COOLDOWN;
   } else {
-    this->state_ = WIFI_COMPONENT_STATE_STA_CONNECTING_2;
+    this->state_ = WIFI_COMPONENT_STATE_STA_CONNECTING;
   }
   this->action_started_ = millis();
 }
@@ -785,6 +787,8 @@ const LogString *get_signal_bars(int8_t rssi) {
 
 void WiFiComponent::print_connect_params_() {
   bssid_t bssid = wifi_bssid();
+  char bssid_s[18];
+  format_mac_addr_upper(bssid.data(), bssid_s);
 
   ESP_LOGCONFIG(TAG, "  Local MAC: %s", get_mac_address_pretty().c_str());
   if (this->is_disabled()) {
@@ -807,12 +811,12 @@ void WiFiComponent::print_connect_params_() {
                                                                            "  Gateway: %s\n"
                                                                            "  DNS1: %s\n"
                                                                            "  DNS2: %s",
-                wifi_ssid().c_str(), format_mac_address_pretty(bssid.data()).c_str(), App.get_name().c_str(), rssi,
-                LOG_STR_ARG(get_signal_bars(rssi)), get_wifi_channel(), wifi_subnet_mask_().str().c_str(),
-                wifi_gateway_ip_().str().c_str(), wifi_dns_ip_(0).str().c_str(), wifi_dns_ip_(1).str().c_str());
+                wifi_ssid().c_str(), bssid_s, App.get_name().c_str(), rssi, LOG_STR_ARG(get_signal_bars(rssi)),
+                get_wifi_channel(), wifi_subnet_mask_().str().c_str(), wifi_gateway_ip_().str().c_str(),
+                wifi_dns_ip_(0).str().c_str(), wifi_dns_ip_(1).str().c_str());
 #ifdef ESPHOME_LOG_HAS_VERBOSE
   if (const WiFiAP *config = this->get_selected_sta_(); config && config->get_bssid().has_value()) {
-    ESP_LOGV(TAG, "  Priority: %.1f", this->get_sta_priority(*config->get_bssid()));
+    ESP_LOGV(TAG, "  Priority: %d", this->get_sta_priority(*config->get_bssid()));
   }
 #endif
 #ifdef USE_WIFI_11KV_SUPPORT
@@ -933,8 +937,7 @@ __attribute__((noinline)) static void log_scan_result(const WiFiScanResult &res)
     ESP_LOGI(TAG, "- '%s' %s" LOG_SECRET("(%s) ") "%s", res.get_ssid().c_str(),
              res.get_is_hidden() ? LOG_STR_LITERAL("(HIDDEN) ") : LOG_STR_LITERAL(""), bssid_s,
              LOG_STR_ARG(get_signal_bars(res.get_rssi())));
-    ESP_LOGD(TAG, "  Channel: %2u, RSSI: %3d dB, Priority: %4.1f", res.get_channel(), res.get_rssi(),
-             res.get_priority());
+    ESP_LOGD(TAG, "  Channel: %2u, RSSI: %3d dB, Priority: %4d", res.get_channel(), res.get_rssi(), res.get_priority());
   } else {
     ESP_LOGD(TAG, "- " LOG_SECRET("'%s'") " " LOG_SECRET("(%s) ") "%s", res.get_ssid().c_str(), bssid_s,
              LOG_STR_ARG(get_signal_bars(res.get_rssi())));
@@ -1003,6 +1006,10 @@ void WiFiComponent::check_scanning_finished() {
     // No scan results matched our configured networks - transition directly to hidden mode
     // Don't call retry_connect() since we never attempted a connection (no BSSID to penalize)
     this->transition_to_phase_(WiFiRetryPhase::RETRY_HIDDEN);
+    // If no hidden networks to try, skip connection attempt (will be handled on next loop)
+    if (this->selected_sta_index_ == -1) {
+      return;
+    }
     // Now start connection attempt in hidden mode
   } else if (this->transition_to_phase_(WiFiRetryPhase::SCAN_CONNECTING)) {
     return;  // scan started, wait for next loop iteration
@@ -1013,7 +1020,7 @@ void WiFiComponent::check_scanning_finished() {
   WiFiAP params = this->build_params_for_current_phase_();
   // Ensure we're in SCAN_CONNECTING phase when connecting with scan results
   // (needed when scan was started directly without transition_to_phase_, e.g., initial scan)
-  this->start_connecting(params, false);
+  this->start_connecting(params);
 }
 
 void WiFiComponent::dump_config() {
@@ -1063,6 +1070,9 @@ void WiFiComponent::check_connecting_finished() {
     this->state_ = WIFI_COMPONENT_STATE_STA_CONNECTED;
     this->num_retried_ = 0;
 
+    // Clear priority tracking if all priorities are at minimum
+    this->clear_priorities_if_all_min_();
+
 #ifdef USE_WIFI_FAST_CONNECT
     this->save_fast_connect_settings_();
 #endif
@@ -1084,7 +1094,7 @@ void WiFiComponent::check_connecting_finished() {
   }
 
   if (this->error_from_callback_) {
-    ESP_LOGW(TAG, "Connecting to network failed");
+    ESP_LOGW(TAG, "Connecting to network failed (callback)");
     this->retry_connect();
     return;
   }
@@ -1142,7 +1152,12 @@ WiFiRetryPhase WiFiComponent::determine_next_phase_() {
         return WiFiRetryPhase::EXPLICIT_HIDDEN;
       }
 
-      // No more consecutive explicitly hidden networks - proceed to scanning
+      // No more consecutive explicitly hidden networks
+      // If ALL networks are hidden, skip scanning and go directly to restart
+      if (this->find_first_non_hidden_index_() < 0) {
+        return WiFiRetryPhase::RESTARTING_ADAPTER;
+      }
+      // Otherwise proceed to scanning for non-hidden networks
       return WiFiRetryPhase::SCAN_CONNECTING;
     }
 
@@ -1160,14 +1175,12 @@ WiFiRetryPhase WiFiComponent::determine_next_phase_() {
       // Its priority has been decreased, so on next scan it will be sorted lower
       // and we'll try the next best BSSID.
       // Check if there are any potentially hidden networks to try
-      if (this->find_next_hidden_sta_(-1, !this->went_through_explicit_hidden_phase_()) >= 0) {
+      if (this->find_next_hidden_sta_(-1) >= 0) {
         return WiFiRetryPhase::RETRY_HIDDEN;  // Found hidden networks to try
       }
-      // No hidden networks - skip directly to restart/rescan
-      if (this->is_captive_portal_active_() || this->is_esp32_improv_active_()) {
-        return this->went_through_explicit_hidden_phase_() ? WiFiRetryPhase::EXPLICIT_HIDDEN
-                                                           : WiFiRetryPhase::SCAN_CONNECTING;
-      }
+      // No hidden networks - always go through RESTARTING_ADAPTER phase
+      // This ensures num_retried_ gets reset and a fresh scan is triggered
+      // The actual adapter restart will be skipped if captive portal/improv is active
       return WiFiRetryPhase::RESTARTING_ADAPTER;
 
     case WiFiRetryPhase::RETRY_HIDDEN:
@@ -1179,20 +1192,18 @@ WiFiRetryPhase WiFiComponent::determine_next_phase_() {
 
         // Exhausted retries on current SSID - check if there are more potentially hidden SSIDs to try
         if (this->selected_sta_index_ < static_cast<int8_t>(this->sta_.size()) - 1) {
-          // More SSIDs available - stay in RETRY_HIDDEN, advance will happen in retry_connect()
-          return WiFiRetryPhase::RETRY_HIDDEN;
+          // Check if find_next_hidden_sta_() would actually find another hidden SSID
+          // as it might have been seen in the scan results and we want to skip those
+          // otherwise we will get stuck in RETRY_HIDDEN phase
+          if (this->find_next_hidden_sta_(this->selected_sta_index_) != -1) {
+            // More hidden SSIDs available - stay in RETRY_HIDDEN, advance will happen in retry_connect()
+            return WiFiRetryPhase::RETRY_HIDDEN;
+          }
         }
       }
-      // Exhausted all potentially hidden SSIDs - rescan to try next BSSID
-      // If captive portal/improv is active, skip adapter restart and go back to start
-      // Otherwise restart adapter to clear any stuck state
-      if (this->is_captive_portal_active_() || this->is_esp32_improv_active_()) {
-        // Go back to explicit hidden if we went through it initially, otherwise scan
-        return this->went_through_explicit_hidden_phase_() ? WiFiRetryPhase::EXPLICIT_HIDDEN
-                                                           : WiFiRetryPhase::SCAN_CONNECTING;
-      }
-
-      // Restart adapter
+      // Exhausted all potentially hidden SSIDs - always go through RESTARTING_ADAPTER
+      // This ensures num_retried_ gets reset and a fresh scan is triggered
+      // The actual adapter restart will be skipped if captive portal/improv is active
       return WiFiRetryPhase::RESTARTING_ADAPTER;
 
     case WiFiRetryPhase::RESTARTING_ADAPTER:
@@ -1212,8 +1223,8 @@ WiFiRetryPhase WiFiComponent::determine_next_phase_() {
 /// - Performing phase-specific initialization (e.g., advancing AP index, starting scans)
 ///
 /// @param new_phase The phase we're transitioning TO
-/// @return true if an async scan was started (caller should wait for completion)
-///         false if no scan started (caller can proceed with connection attempt)
+/// @return true if connection attempt should be skipped (scan started or no networks to try)
+///         false if caller can proceed with connection attempt
 bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
   WiFiRetryPhase old_phase = this->retry_phase_;
 
@@ -1271,7 +1282,7 @@ bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
         // If first network is marked hidden, we went through EXPLICIT_HIDDEN phase
         // In that case, skip networks marked hidden:true (already tried)
         // Otherwise, include them (they haven't been tried yet)
-        this->selected_sta_index_ = this->find_next_hidden_sta_(-1, !this->went_through_explicit_hidden_phase_());
+        this->selected_sta_index_ = this->find_next_hidden_sta_(-1);
 
         if (this->selected_sta_index_ == -1) {
           ESP_LOGD(TAG, "All SSIDs visible or already tried, skipping hidden mode");
@@ -1280,7 +1291,12 @@ bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
       break;
 
     case WiFiRetryPhase::RESTARTING_ADAPTER:
-      this->restart_adapter();
+      // Skip actual adapter restart if captive portal/improv is active
+      // This allows state machine to reset num_retried_ and trigger fresh scan
+      // without disrupting the captive portal/improv connection
+      if (!this->is_captive_portal_active_() && !this->is_esp32_improv_active_()) {
+        this->restart_adapter();
+      }
       // Return true to indicate we should wait (go to COOLDOWN) instead of immediately connecting
       return true;
 
@@ -1291,6 +1307,34 @@ bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
   return false;  // Did not start scan, can proceed with connection
 }
 
+/// Clear BSSID priority tracking if all priorities are at minimum (saves memory)
+/// At minimum priority, all BSSIDs are equally bad, so priority tracking is useless
+/// Called after successful connection or after failed connection attempts
+void WiFiComponent::clear_priorities_if_all_min_() {
+  if (this->sta_priorities_.empty()) {
+    return;
+  }
+
+  int8_t first_priority = this->sta_priorities_[0].priority;
+
+  // Only clear if all priorities have been decremented to the minimum value
+  // At this point, all BSSIDs have been equally penalized and priority info is useless
+  if (first_priority != std::numeric_limits<int8_t>::min()) {
+    return;
+  }
+
+  for (const auto &pri : this->sta_priorities_) {
+    if (pri.priority != first_priority) {
+      return;  // Not all same, nothing to do
+    }
+  }
+
+  // All priorities are at minimum - clear the vector to save memory and reset
+  ESP_LOGD(TAG, "Clearing BSSID priorities (all at minimum)");
+  this->sta_priorities_.clear();
+  this->sta_priorities_.shrink_to_fit();
+}
+
 /// Log failed connection attempt and decrease BSSID priority to avoid repeated failures
 /// This function identifies which BSSID was attempted (from scan results or config),
 /// decreases its priority by 1.0 to discourage future attempts, and logs the change.
@@ -1304,6 +1348,11 @@ bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
 /// - Other phases: Uses BSSID from config if explicitly specified by user or fast_connect
 ///
 /// If no BSSID is available (SSID-only connection), priority adjustment is skipped.
+///
+/// IMPORTANT: Priority is only decreased on the LAST attempt for a BSSID in SCAN_CONNECTING phase.
+/// This prevents false positives from transient WiFi stack state issues after scanning.
+/// Single failures don't necessarily mean the AP is bad - two genuine failures provide
+/// higher confidence before degrading priority and skipping the BSSID in future scans.
 void WiFiComponent::log_and_adjust_priority_for_failed_connect_() {
   // Determine which BSSID we tried to connect to
   optional<bssid_t> failed_bssid;
@@ -1320,11 +1369,6 @@ void WiFiComponent::log_and_adjust_priority_for_failed_connect_() {
     return;  // No BSSID to penalize
   }
 
-  // Decrease priority to avoid repeatedly trying the same failed BSSID
-  float old_priority = this->get_sta_priority(failed_bssid.value());
-  float new_priority = old_priority - 1.0f;
-  this->set_sta_priority(failed_bssid.value(), new_priority);
-
   // Get SSID for logging
   std::string ssid;
   if (this->retry_phase_ == WiFiRetryPhase::SCAN_CONNECTING && !this->scan_result_.empty()) {
@@ -1333,8 +1377,29 @@ void WiFiComponent::log_and_adjust_priority_for_failed_connect_() {
     ssid = config->get_ssid();
   }
 
-  ESP_LOGD(TAG, "Failed " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") ", priority %.1f → %.1f", ssid.c_str(),
-           format_mac_address_pretty(failed_bssid.value().data()).c_str(), old_priority, new_priority);
+  // Only decrease priority on the last attempt for this phase
+  // This prevents false positives from transient WiFi stack issues
+  uint8_t max_retries = get_max_retries_for_phase(this->retry_phase_);
+  bool is_last_attempt = (this->num_retried_ + 1 >= max_retries);
+
+  // Decrease priority only on last attempt to avoid false positives from transient failures
+  int8_t old_priority = this->get_sta_priority(failed_bssid.value());
+  int8_t new_priority = old_priority;
+
+  if (is_last_attempt) {
+    // Decrease priority, but clamp to int8_t::min to prevent overflow
+    new_priority =
+        (old_priority > std::numeric_limits<int8_t>::min()) ? (old_priority - 1) : std::numeric_limits<int8_t>::min();
+    this->set_sta_priority(failed_bssid.value(), new_priority);
+  }
+  char bssid_s[18];
+  format_mac_addr_upper(failed_bssid.value().data(), bssid_s);
+  ESP_LOGD(TAG, "Failed " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") ", priority %d → %d", ssid.c_str(), bssid_s,
+           old_priority, new_priority);
+
+  // After adjusting priority, check if all priorities are now at minimum
+  // If so, clear the vector to save memory and reset for fresh start
+  this->clear_priorities_if_all_min_();
 }
 
 /// Handle target advancement or retry counter increment when staying in the same phase
@@ -1379,8 +1444,7 @@ void WiFiComponent::advance_to_next_target_or_increment_retry_() {
     // If first network is marked hidden, we went through EXPLICIT_HIDDEN phase
     // In that case, skip networks marked hidden:true (already tried)
     // Otherwise, include them (they haven't been tried yet)
-    int8_t next_index =
-        this->find_next_hidden_sta_(this->selected_sta_index_, !this->went_through_explicit_hidden_phase_());
+    int8_t next_index = this->find_next_hidden_sta_(this->selected_sta_index_);
     if (next_index != -1) {
       // Found another potentially hidden SSID
       this->selected_sta_index_ = next_index;
@@ -1408,15 +1472,13 @@ void WiFiComponent::advance_to_next_target_or_increment_retry_() {
 void WiFiComponent::retry_connect() {
   this->log_and_adjust_priority_for_failed_connect_();
 
-  delay(10);
-
   // Determine next retry phase based on current state
   WiFiRetryPhase current_phase = this->retry_phase_;
   WiFiRetryPhase next_phase = this->determine_next_phase_();
 
   // Handle phase transitions (transition_to_phase_ handles same-phase no-op internally)
   if (this->transition_to_phase_(next_phase)) {
-    return;  // Wait for scan to complete
+    return;  // Scan started or adapter restarted (which sets its own state)
   }
 
   if (next_phase == current_phase) {
@@ -1425,22 +1487,14 @@ void WiFiComponent::retry_connect() {
 
   this->error_from_callback_ = false;
 
-  if (this->state_ == WIFI_COMPONENT_STATE_STA_CONNECTING) {
-    yield();
-    // Check if we have a valid target before building params
-    // After exhausting all networks in a phase, selected_sta_index_ may be -1
-    // In that case, skip connection and let next wifi_loop() handle phase transition
-    if (this->selected_sta_index_ >= 0) {
-      this->state_ = WIFI_COMPONENT_STATE_STA_CONNECTING_2;
-      WiFiAP params = this->build_params_for_current_phase_();
-      this->start_connecting(params, true);
-      return;
-    }
-    // No valid target - fall through to set state to allow phase transition
+  yield();
+  // Check if we have a valid target before building params
+  // After exhausting all networks in a phase, selected_sta_index_ may be -1
+  // In that case, skip connection and let next wifi_loop() handle phase transition
+  if (this->selected_sta_index_ >= 0) {
+    WiFiAP params = this->build_params_for_current_phase_();
+    this->start_connecting(params);
   }
-
-  this->state_ = WIFI_COMPONENT_STATE_COOLDOWN;
-  this->action_started_ = millis();
 }
 
 void WiFiComponent::set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
@@ -1532,7 +1586,9 @@ void WiFiAP::set_password(const std::string &password) { this->password_ = passw
 void WiFiAP::set_eap(optional<EAPAuth> eap_auth) { this->eap_ = std::move(eap_auth); }
 #endif
 void WiFiAP::set_channel(optional<uint8_t> channel) { this->channel_ = channel; }
+#ifdef USE_WIFI_MANUAL_IP
 void WiFiAP::set_manual_ip(optional<ManualIP> manual_ip) { this->manual_ip_ = manual_ip; }
+#endif
 void WiFiAP::set_hidden(bool hidden) { this->hidden_ = hidden; }
 const std::string &WiFiAP::get_ssid() const { return this->ssid_; }
 const optional<bssid_t> &WiFiAP::get_bssid() const { return this->bssid_; }
@@ -1541,15 +1597,17 @@ const std::string &WiFiAP::get_password() const { return this->password_; }
 const optional<EAPAuth> &WiFiAP::get_eap() const { return this->eap_; }
 #endif
 const optional<uint8_t> &WiFiAP::get_channel() const { return this->channel_; }
+#ifdef USE_WIFI_MANUAL_IP
 const optional<ManualIP> &WiFiAP::get_manual_ip() const { return this->manual_ip_; }
+#endif
 bool WiFiAP::get_hidden() const { return this->hidden_; }
 
 WiFiScanResult::WiFiScanResult(const bssid_t &bssid, std::string ssid, uint8_t channel, int8_t rssi, bool with_auth,
                                bool is_hidden)
     : bssid_(bssid),
-      ssid_(std::move(ssid)),
       channel_(channel),
       rssi_(rssi),
+      ssid_(std::move(ssid)),
       with_auth_(with_auth),
       is_hidden_(is_hidden) {}
 bool WiFiScanResult::matches(const WiFiAP &config) const {

esphome/components/wifi/wifi_component.h

@@ -74,12 +74,6 @@ enum WiFiComponentState : uint8_t {
   WIFI_COMPONENT_STATE_STA_SCANNING,
   /** WiFi is in STA(+AP) mode and currently connecting to an AP. */
   WIFI_COMPONENT_STATE_STA_CONNECTING,
-  /** WiFi is in STA(+AP) mode and currently connecting to an AP a second time.
-   *
-   * This is required because for some reason ESPs don't like to connect to WiFi APs directly after
-   * a scan.
-   * */
-  WIFI_COMPONENT_STATE_STA_CONNECTING_2,
   /** WiFi is in STA(+AP) mode and successfully connected. */
   WIFI_COMPONENT_STATE_STA_CONNECTED,
   /** WiFi is in AP-only mode and internal AP is already enabled. */
@@ -157,8 +151,10 @@ class WiFiAP {
   void set_eap(optional<EAPAuth> eap_auth);
 #endif  // USE_WIFI_WPA2_EAP
   void set_channel(optional<uint8_t> channel);
-  void set_priority(float priority) { priority_ = priority; }
+  void set_priority(int8_t priority) { priority_ = priority; }
+#ifdef USE_WIFI_MANUAL_IP
   void set_manual_ip(optional<ManualIP> manual_ip);
+#endif
   void set_hidden(bool hidden);
   const std::string &get_ssid() const;
   const optional<bssid_t> &get_bssid() const;
@@ -167,8 +163,10 @@ class WiFiAP {
   const optional<EAPAuth> &get_eap() const;
 #endif  // USE_WIFI_WPA2_EAP
   const optional<uint8_t> &get_channel() const;
-  float get_priority() const { return priority_; }
+  int8_t get_priority() const { return priority_; }
+#ifdef USE_WIFI_MANUAL_IP
   const optional<ManualIP> &get_manual_ip() const;
+#endif
   bool get_hidden() const;
 
  protected:
@@ -178,9 +176,11 @@ class WiFiAP {
 #ifdef USE_WIFI_WPA2_EAP
   optional<EAPAuth> eap_;
 #endif  // USE_WIFI_WPA2_EAP
+#ifdef USE_WIFI_MANUAL_IP
   optional<ManualIP> manual_ip_;
-  float priority_{0};
+#endif
   optional<uint8_t> channel_;
+  int8_t priority_{0};
   bool hidden_{false};
 };
 
@@ -198,17 +198,17 @@ class WiFiScanResult {
   int8_t get_rssi() const;
   bool get_with_auth() const;
   bool get_is_hidden() const;
-  float get_priority() const { return priority_; }
-  void set_priority(float priority) { priority_ = priority; }
+  int8_t get_priority() const { return priority_; }
+  void set_priority(int8_t priority) { priority_ = priority; }
 
   bool operator==(const WiFiScanResult &rhs) const;
 
  protected:
   bssid_t bssid_;
-  std::string ssid_;
-  float priority_{0.0f};
   uint8_t channel_;
   int8_t rssi_;
+  std::string ssid_;
+  int8_t priority_{0};
   bool matches_{false};
   bool with_auth_;
   bool is_hidden_;
@@ -216,7 +216,7 @@ class WiFiScanResult {
 
 struct WiFiSTAPriority {
   bssid_t bssid;
-  float priority;
+  int8_t priority;
 };
 
 enum WiFiPowerSaveMode : uint8_t {
@@ -225,6 +225,12 @@ enum WiFiPowerSaveMode : uint8_t {
   WIFI_POWER_SAVE_HIGH,
 };
 
+enum WifiMinAuthMode : uint8_t {
+  WIFI_MIN_AUTH_MODE_WPA = 0,
+  WIFI_MIN_AUTH_MODE_WPA2,
+  WIFI_MIN_AUTH_MODE_WPA3,
+};
+
 #ifdef USE_ESP32
 struct IDFWiFiEvent;
 #endif
@@ -263,7 +269,9 @@ class WiFiComponent : public Component {
   bool is_disabled();
   void start_scanning();
   void check_scanning_finished();
-  void start_connecting(const WiFiAP &ap, bool two);
+  void start_connecting(const WiFiAP &ap);
+  // Backward compatibility overload - ignores 'two' parameter
+  void start_connecting(const WiFiAP &ap, bool /* two */) { this->start_connecting(ap); }
 
   void check_connecting_finished();
 
@@ -274,6 +282,7 @@ class WiFiComponent : public Component {
   bool is_connected();
 
   void set_power_save_mode(WiFiPowerSaveMode power_save);
+  void set_min_auth_mode(WifiMinAuthMode min_auth_mode) { min_auth_mode_ = min_auth_mode; }
   void set_output_power(float output_power) { output_power_ = output_power; }
 
   void set_passive_scan(bool passive);
@@ -317,14 +326,14 @@ class WiFiComponent : public Component {
     }
     return false;
   }
-  float get_sta_priority(const bssid_t bssid) {
+  int8_t get_sta_priority(const bssid_t bssid) {
     for (auto &it : this->sta_priorities_) {
       if (it.bssid == bssid)
         return it.priority;
     }
-    return 0.0f;
+    return 0;
   }
-  void set_sta_priority(const bssid_t bssid, float priority) {
+  void set_sta_priority(const bssid_t bssid, int8_t priority) {
     for (auto &it : this->sta_priorities_) {
       if (it.bssid == bssid) {
         it.priority = priority;
@@ -379,10 +388,11 @@ class WiFiComponent : public Component {
   /// Find next SSID that wasn't in scan results (might be hidden)
   /// Returns index of next potentially hidden SSID, or -1 if none found
   /// @param start_index Start searching from index after this (-1 to start from beginning)
-  /// @param include_explicit_hidden If true, include SSIDs marked hidden:true. If false, only find truly hidden SSIDs.
-  int8_t find_next_hidden_sta_(int8_t start_index, bool include_explicit_hidden = true);
+  int8_t find_next_hidden_sta_(int8_t start_index);
   /// Log failed connection and decrease BSSID priority to avoid repeated attempts
   void log_and_adjust_priority_for_failed_connect_();
+  /// Clear BSSID priority tracking if all priorities are at minimum (saves memory)
+  void clear_priorities_if_all_min_();
   /// Advance to next target (AP/SSID) within current phase, or increment retry counter
   /// Called when staying in the same phase after a failed connection attempt
   void advance_to_next_target_or_increment_retry_();
@@ -416,7 +426,7 @@ class WiFiComponent : public Component {
   bool wifi_sta_pre_setup_();
   bool wifi_apply_output_power_(float output_power);
   bool wifi_apply_power_save_();
-  bool wifi_sta_ip_config_(optional<ManualIP> manual_ip);
+  bool wifi_sta_ip_config_(const optional<ManualIP> &manual_ip);
   bool wifi_apply_hostname_();
   bool wifi_sta_connect_(const WiFiAP &ap);
   void wifi_pre_setup_();
@@ -424,7 +434,7 @@ class WiFiComponent : public Component {
   bool wifi_scan_start_(bool passive);
 
 #ifdef USE_WIFI_AP
-  bool wifi_ap_ip_config_(optional<ManualIP> manual_ip);
+  bool wifi_ap_ip_config_(const optional<ManualIP> &manual_ip);
   bool wifi_start_ap_(const WiFiAP &ap);
 #endif  // USE_WIFI_AP
 
@@ -489,6 +499,7 @@ class WiFiComponent : public Component {
   // Group all 8-bit values together
   WiFiComponentState state_{WIFI_COMPONENT_STATE_OFF};
   WiFiPowerSaveMode power_save_{WIFI_POWER_SAVE_NONE};
+  WifiMinAuthMode min_auth_mode_{WIFI_MIN_AUTH_MODE_WPA2};
   WiFiRetryPhase retry_phase_{WiFiRetryPhase::INITIAL_CONNECT};
   uint8_t num_retried_{0};
   // Index into sta_ array for the currently selected AP configuration (-1 = none selected)

esphome/components/wifi/wifi_component_esp8266.cpp

@@ -117,7 +117,7 @@ void netif_set_addr(struct netif *netif, const ip4_addr_t *ip, const ip4_addr_t
 };
 #endif
 
-bool WiFiComponent::wifi_sta_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_sta_ip_config_(const optional<ManualIP> &manual_ip) {
   // enable STA
   if (!this->wifi_mode_(true, {}))
     return false;
@@ -258,8 +258,17 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   if (ap.get_password().empty()) {
     conf.threshold.authmode = AUTH_OPEN;
   } else {
-    // Only allow auth modes with at least WPA
-    conf.threshold.authmode = AUTH_WPA_PSK;
+    // Set threshold based on configured minimum auth mode
+    // Note: ESP8266 doesn't support WPA3
+    switch (this->min_auth_mode_) {
+      case WIFI_MIN_AUTH_MODE_WPA:
+        conf.threshold.authmode = AUTH_WPA_PSK;
+        break;
+      case WIFI_MIN_AUTH_MODE_WPA2:
+      case WIFI_MIN_AUTH_MODE_WPA3:  // Fall back to WPA2 for ESP8266
+        conf.threshold.authmode = AUTH_WPA2_PSK;
+        break;
+    }
   }
   conf.threshold.rssi = -127;
 #endif
@@ -273,9 +282,15 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
     return false;
   }
 
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_sta_ip_config_(ap.get_manual_ip())) {
     return false;
   }
+#else
+  if (!this->wifi_sta_ip_config_({})) {
+    return false;
+  }
+#endif
 
   // setup enterprise authentication if required
 #ifdef USE_WIFI_WPA2_EAP
@@ -510,8 +525,10 @@ void WiFiComponent::wifi_event_callback(System_Event_t *event) {
         ESP_LOGW(TAG, "Disconnected ssid='%s' reason='Probe Request Unsuccessful'", buf);
         s_sta_connect_not_found = true;
       } else {
-        ESP_LOGW(TAG, "Disconnected ssid='%s' bssid=" LOG_SECRET("%s") " reason='%s'", buf,
-                 format_mac_address_pretty(it.bssid).c_str(), LOG_STR_ARG(get_disconnect_reason_str(it.reason)));
+        char bssid_s[18];
+        format_mac_addr_upper(it.bssid, bssid_s);
+        ESP_LOGW(TAG, "Disconnected ssid='%s' bssid=" LOG_SECRET("%s") " reason='%s'", buf, bssid_s,
+                 LOG_STR_ARG(get_disconnect_reason_str(it.reason)));
         s_sta_connect_error = true;
       }
       s_sta_connected = false;
@@ -715,7 +732,7 @@ void WiFiComponent::wifi_scan_done_callback_(void *arg, STATUS status) {
 }
 
 #ifdef USE_WIFI_AP
-bool WiFiComponent::wifi_ap_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_ap_ip_config_(const optional<ManualIP> &manual_ip) {
   // enable AP
   if (!this->wifi_mode_({}, true))
     return false;
@@ -823,10 +840,17 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
     return false;
   }
 
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_ap_ip_config_(ap.get_manual_ip())) {
     ESP_LOGV(TAG, "wifi_ap_ip_config_ failed");
     return false;
   }
+#else
+  if (!this->wifi_ap_ip_config_({})) {
+    ESP_LOGV(TAG, "wifi_ap_ip_config_ failed");
+    return false;
+  }
+#endif
 
   return true;
 }

esphome/components/wifi/wifi_component_esp_idf.cpp

@@ -308,7 +308,18 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   if (ap.get_password().empty()) {
     conf.sta.threshold.authmode = WIFI_AUTH_OPEN;
   } else {
-    conf.sta.threshold.authmode = WIFI_AUTH_WPA_WPA2_PSK;
+    // Set threshold based on configured minimum auth mode
+    switch (this->min_auth_mode_) {
+      case WIFI_MIN_AUTH_MODE_WPA:
+        conf.sta.threshold.authmode = WIFI_AUTH_WPA_PSK;
+        break;
+      case WIFI_MIN_AUTH_MODE_WPA2:
+        conf.sta.threshold.authmode = WIFI_AUTH_WPA2_PSK;
+        break;
+      case WIFI_MIN_AUTH_MODE_WPA3:
+        conf.sta.threshold.authmode = WIFI_AUTH_WPA3_PSK;
+        break;
+    }
   }
 
 #ifdef USE_WIFI_WPA2_EAP
@@ -347,8 +358,6 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   // The minimum rssi to accept in the fast scan mode
   conf.sta.threshold.rssi = -127;
 
-  conf.sta.threshold.authmode = WIFI_AUTH_OPEN;
-
   wifi_config_t current_conf;
   esp_err_t err;
   err = esp_wifi_get_config(WIFI_IF_STA, &current_conf);
@@ -371,9 +380,15 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
     return false;
   }
 
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_sta_ip_config_(ap.get_manual_ip())) {
     return false;
   }
+#else
+  if (!this->wifi_sta_ip_config_({})) {
+    return false;
+  }
+#endif
 
   // setup enterprise authentication if required
 #ifdef USE_WIFI_WPA2_EAP
@@ -472,7 +487,7 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   return true;
 }
 
-bool WiFiComponent::wifi_sta_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_sta_ip_config_(const optional<ManualIP> &manual_ip) {
   // enable STA
   if (!this->wifi_mode_(true, {}))
     return false;
@@ -731,8 +746,10 @@ void WiFiComponent::wifi_process_event_(IDFWiFiEvent *data) {
       ESP_LOGI(TAG, "Disconnected ssid='%s' reason='Station Roaming'", buf);
       return;
     } else {
-      ESP_LOGW(TAG, "Disconnected ssid='%s' bssid=" LOG_SECRET("%s") " reason='%s'", buf,
-               format_mac_address_pretty(it.bssid).c_str(), get_disconnect_reason_str(it.reason));
+      char bssid_s[18];
+      format_mac_addr_upper(it.bssid, bssid_s);
+      ESP_LOGW(TAG, "Disconnected ssid='%s' bssid=" LOG_SECRET("%s") " reason='%s'", buf, bssid_s,
+               get_disconnect_reason_str(it.reason));
       s_sta_connect_error = true;
     }
     s_sta_connected = false;
@@ -869,7 +886,7 @@ bool WiFiComponent::wifi_scan_start_(bool passive) {
 }
 
 #ifdef USE_WIFI_AP
-bool WiFiComponent::wifi_ap_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_ap_ip_config_(const optional<ManualIP> &manual_ip) {
   esp_err_t err;
 
   // enable AP
@@ -985,10 +1002,17 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
     return false;
   }
 
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_ap_ip_config_(ap.get_manual_ip())) {
     ESP_LOGE(TAG, "wifi_ap_ip_config_ failed:");
     return false;
   }
+#else
+  if (!this->wifi_ap_ip_config_({})) {
+    ESP_LOGE(TAG, "wifi_ap_ip_config_ failed:");
+    return false;
+  }
+#endif
 
   return true;
 }

esphome/components/wifi/wifi_component_libretiny.cpp

@@ -68,7 +68,7 @@ bool WiFiComponent::wifi_sta_pre_setup_() {
   return true;
 }
 bool WiFiComponent::wifi_apply_power_save_() { return WiFi.setSleep(this->power_save_ != WIFI_POWER_SAVE_NONE); }
-bool WiFiComponent::wifi_sta_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_sta_ip_config_(const optional<ManualIP> &manual_ip) {
   // enable STA
   if (!this->wifi_mode_(true, {}))
     return false;
@@ -112,9 +112,15 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
     WiFi.disconnect();
   }
 
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_sta_ip_config_(ap.get_manual_ip())) {
     return false;
   }
+#else
+  if (!this->wifi_sta_ip_config_({})) {
+    return false;
+  }
+#endif
 
   this->wifi_apply_hostname_();
 
@@ -293,8 +299,10 @@ void WiFiComponent::wifi_event_callback_(esphome_wifi_event_id_t event, esphome_
       if (it.reason == WIFI_REASON_NO_AP_FOUND) {
         ESP_LOGW(TAG, "Disconnected ssid='%s' reason='Probe Request Unsuccessful'", buf);
       } else {
-        ESP_LOGW(TAG, "Disconnected ssid='%s' bssid=" LOG_SECRET("%s") " reason='%s'", buf,
-                 format_mac_address_pretty(it.bssid).c_str(), get_disconnect_reason_str(it.reason));
+        char bssid_s[18];
+        format_mac_addr_upper(it.bssid, bssid_s);
+        ESP_LOGW(TAG, "Disconnected ssid='%s' bssid=" LOG_SECRET("%s") " reason='%s'", buf, bssid_s,
+                 get_disconnect_reason_str(it.reason));
       }
 
       uint8_t reason = it.reason;
@@ -428,7 +436,7 @@ void WiFiComponent::wifi_scan_done_callback_() {
 }
 
 #ifdef USE_WIFI_AP
-bool WiFiComponent::wifi_ap_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_ap_ip_config_(const optional<ManualIP> &manual_ip) {
   // enable AP
   if (!this->wifi_mode_({}, true))
     return false;
@@ -445,10 +453,17 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
   if (!this->wifi_mode_({}, true))
     return false;
 
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_ap_ip_config_(ap.get_manual_ip())) {
     ESP_LOGV(TAG, "wifi_ap_ip_config_ failed");
     return false;
   }
+#else
+  if (!this->wifi_ap_ip_config_({})) {
+    ESP_LOGV(TAG, "wifi_ap_ip_config_ failed");
+    return false;
+  }
+#endif
 
   yield();
 

esphome/components/wifi/wifi_component_pico_w.cpp

@@ -55,8 +55,13 @@ bool WiFiComponent::wifi_apply_power_save_() {
 bool WiFiComponent::wifi_apply_output_power_(float output_power) { return true; }
 
 bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_sta_ip_config_(ap.get_manual_ip()))
     return false;
+#else
+  if (!this->wifi_sta_ip_config_({}))
+    return false;
+#endif
 
   auto ret = WiFi.begin(ap.get_ssid().c_str(), ap.get_password().c_str());
   if (ret != WL_CONNECTED)
@@ -67,7 +72,7 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
 
 bool WiFiComponent::wifi_sta_pre_setup_() { return this->wifi_mode_(true, {}); }
 
-bool WiFiComponent::wifi_sta_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_sta_ip_config_(const optional<ManualIP> &manual_ip) {
   if (!manual_ip.has_value()) {
     return true;
   }
@@ -141,7 +146,7 @@ bool WiFiComponent::wifi_scan_start_(bool passive) {
 }
 
 #ifdef USE_WIFI_AP
-bool WiFiComponent::wifi_ap_ip_config_(optional<ManualIP> manual_ip) {
+bool WiFiComponent::wifi_ap_ip_config_(const optional<ManualIP> &manual_ip) {
   esphome::network::IPAddress ip_address, gateway, subnet, dns;
   if (manual_ip.has_value()) {
     ip_address = manual_ip->static_ip;
@@ -161,10 +166,17 @@ bool WiFiComponent::wifi_ap_ip_config_(optional<ManualIP> manual_ip) {
 bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
   if (!this->wifi_mode_({}, true))
     return false;
+#ifdef USE_WIFI_MANUAL_IP
   if (!this->wifi_ap_ip_config_(ap.get_manual_ip())) {
     ESP_LOGV(TAG, "wifi_ap_ip_config_ failed");
     return false;
   }
+#else
+  if (!this->wifi_ap_ip_config_({})) {
+    ESP_LOGV(TAG, "wifi_ap_ip_config_ failed");
+    return false;
+  }
+#endif
 
   WiFi.beginAP(ap.get_ssid().c_str(), ap.get_password().c_str(), ap.get_channel().value_or(1));
 

esphome/const.py

@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2025.11.0-dev"
+__version__ = "2025.11.0b1"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

esphome/core/base_automation.h

@@ -412,7 +412,12 @@ template<typename... Ts> class WaitUntilAction : public Action<Ts...>, public Co
 
   void setup() override {
     // Start with loop disabled - only enable when there's work to do
-    this->disable_loop();
+    // IMPORTANT: Only disable if num_running_ is 0, otherwise play_complex() was already
+    // called before our setup() (e.g., from on_boot trigger at same priority level)
+    // and we must not undo its enable_loop() call
+    if (this->num_running_ == 0) {
+      this->disable_loop();
+    }
   }
 
   void play_complex(const Ts &...x) override {

esphome/core/defines.h

@@ -144,6 +144,7 @@
 #define USE_TIME_TIMEZONE
 #define USE_WIFI
 #define USE_WIFI_AP
+#define USE_WIFI_MANUAL_IP
 #define USE_WIREGUARD
 #endif
 

requirements_test.txt

@@ -5,7 +5,7 @@ pyupgrade==3.21.1  # also change in .pre-commit-config.yaml when updating
 pre-commit
 
 # Unit tests
-pytest==9.0.0
+pytest==9.0.1
 pytest-cov==7.0.0
 pytest-mock==3.15.1
 pytest-asyncio==1.3.0

tests/components/binary_sensor/test.esp32-s3-idf.yaml

@@ -1,2 +0,0 @@
-packages:
-  common: !include common.yaml

tests/components/bme68x_bsec2_i2c/test.esp32-s3-idf.yaml

@@ -1,4 +0,0 @@
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/matrix_keypad/test.esp32-s3-idf.yaml

@@ -1,15 +0,0 @@
-packages:
-  common: !include common.yaml
-
-matrix_keypad:
-  id: keypad
-  rows:
-    - pin: 10
-    - pin: 11
-  columns:
-    - pin: 12
-    - pin: 13
-  keys: "1234"
-  has_pulldowns: true
-  on_key:
-    - lambda: ESP_LOGI("KEY", "key %d pressed", x);

tests/components/mcp3221/test.esp32-s3-idf.yaml

@@ -1,4 +0,0 @@
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/mlx90393/test.esp32-s3-idf.yaml

@@ -1,4 +0,0 @@
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/network/test.esp32-idf.yaml

@@ -1 +1,4 @@
 <<: !include common.yaml
+
+network:
+  enable_high_performance: true

tests/components/npi19/test.esp32-s3-idf.yaml

@@ -1,4 +0,0 @@
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/nrf52/test.nrf52-xiao-ble.yaml

@@ -6,4 +6,4 @@ nrf52:
       mode:
         output: true
   reg0:
-    voltage: default
+    voltage: 1.8V

tests/components/ntc/test.esp32-s3-idf.yaml

@@ -1,4 +0,0 @@
-substitutions:
-  pin: GPIO4
-
-<<: !include common.yaml

tests/components/resistance/test.esp32-s3-idf.yaml

@@ -1,4 +0,0 @@
-substitutions:
-  pin: GPIO1
-
-<<: !include common.yaml

tests/components/switch/test.esp32-s3-idf.yaml

@@ -1,2 +0,0 @@
-packages:
-  common: !include common.yaml

tests/components/tem3200/test.esp32-s3-idf.yaml

@@ -1,8 +0,0 @@
-substitutions:
-  scl_pin: GPIO40
-  sda_pin: GPIO41
-
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/template/test.esp32-s3-idf.yaml

@@ -1,2 +0,0 @@
-packages:
-  common: !include common.yaml

tests/components/uart/test-uart_max_with_usb_serial_jtag.esp32-s3-idf.yaml

@@ -1,48 +0,0 @@
-<<: !include ../logger/common-usb_serial_jtag.yaml
-
-esphome:
-  on_boot:
-    then:
-      - uart.write:
-          id: uart_1
-          data: 'Hello World'
-      - uart.write:
-          id: uart_1
-          data: [0x00, 0x20, 0x42]
-
-uart:
-  - id: uart_1
-    tx_pin: 4
-    rx_pin: 5
-    flow_control_pin: 6
-    baud_rate: 9600
-    data_bits: 8
-    rx_buffer_size: 512
-    rx_full_threshold: 10
-    rx_timeout: 1
-    parity: EVEN
-    stop_bits: 2
-
-  - id: uart_2
-    tx_pin: 7
-    rx_pin: 8
-    flow_control_pin: 9
-    baud_rate: 9600
-    data_bits: 8
-    rx_buffer_size: 512
-    rx_full_threshold: 10
-    rx_timeout: 1
-    parity: EVEN
-    stop_bits: 2
-
-  - id: uart_3
-    tx_pin: 10
-    rx_pin: 11
-    flow_control_pin: 12
-    baud_rate: 9600
-    data_bits: 8
-    rx_buffer_size: 512
-    rx_full_threshold: 10
-    rx_timeout: 1
-    parity: EVEN
-    stop_bits: 2

tests/components/wifi/common.yaml

@@ -15,5 +15,10 @@ wifi:
   networks:
     - ssid: MySSID
       password: password1
+      priority: 10
     - ssid: MySSID2
       password: password2
+      priority: 5
+    - ssid: MySSID3
+      password: password3
+      priority: 0

tests/components/wifi/test.esp32-idf.yaml

@@ -2,6 +2,22 @@ psram:
 
 wifi:
   use_psram: true
+  min_auth_mode: WPA
+  manual_ip:
+    static_ip: 192.168.1.100
+    gateway: 192.168.1.1
+    subnet: 255.255.255.0
+    dns1: 1.1.1.1
+    dns2: 8.8.8.8
+  ap:
+    ssid: Fallback AP
+    password: fallback_password
+    manual_ip:
+      static_ip: 192.168.4.1
+      gateway: 192.168.4.1
+      subnet: 255.255.255.0
+
+captive_portal:
 
 packages:
   - !include common.yaml

tests/components/wifi/test.esp8266-ard.yaml

@@ -1 +1,5 @@
-<<: !include common.yaml
+wifi:
+  min_auth_mode: WPA2
+
+packages:
+  - !include common.yaml

tests/components/wk2132_i2c/test.esp32-s3-idf.yaml

@@ -1,9 +0,0 @@
-substitutions:
-  scl_pin: GPIO40
-  sda_pin: GPIO41
-
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-  uart_bridge_2: !include ../../test_build_components/common/uart_bridge_2/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2132_spi/test.esp32-s3-idf.yaml

@@ -1,11 +0,0 @@
-substitutions:
-  clk_pin: GPIO40
-  miso_pin: GPIO41
-  mosi_pin: GPIO6
-  cs_pin: GPIO19
-
-packages:
-  spi: !include ../../test_build_components/common/spi/esp32-s3-idf.yaml
-  uart_bridge_2: !include ../../test_build_components/common/uart_bridge_2/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2168_i2c/test.esp32-s3-idf.yaml

@@ -1,9 +0,0 @@
-substitutions:
-  scl_pin: GPIO40
-  sda_pin: GPIO41
-
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-  uart_bridge_4: !include ../../test_build_components/common/uart_bridge_4/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2168_spi/test.esp32-s3-idf.yaml

@@ -1,11 +0,0 @@
-substitutions:
-  clk_pin: GPIO40
-  miso_pin: GPIO41
-  mosi_pin: GPIO6
-  cs_pin: GPIO19
-
-packages:
-  spi: !include ../../test_build_components/common/spi/esp32-s3-idf.yaml
-  uart_bridge_4: !include ../../test_build_components/common/uart_bridge_4/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2204_i2c/test.esp32-s3-idf.yaml

@@ -1,9 +0,0 @@
-substitutions:
-  scl_pin: GPIO40
-  sda_pin: GPIO41
-
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-  uart_bridge_4: !include ../../test_build_components/common/uart_bridge_4/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2204_spi/test.esp32-s3-idf.yaml

@@ -1,11 +0,0 @@
-substitutions:
-  clk_pin: GPIO40
-  miso_pin: GPIO41
-  mosi_pin: GPIO6
-  cs_pin: GPIO19
-
-packages:
-  spi: !include ../../test_build_components/common/spi/esp32-s3-idf.yaml
-  uart_bridge_4: !include ../../test_build_components/common/uart_bridge_4/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2212_i2c/test.esp32-s3-idf.yaml

@@ -1,9 +0,0 @@
-substitutions:
-  scl_pin: GPIO40
-  sda_pin: GPIO41
-
-packages:
-  i2c: !include ../../test_build_components/common/i2c/esp32-s3-idf.yaml
-  uart_bridge_4: !include ../../test_build_components/common/uart_bridge_4/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/components/wk2212_spi/test.esp32-s3-idf.yaml

@@ -1,11 +0,0 @@
-substitutions:
-  clk_pin: GPIO40
-  miso_pin: GPIO41
-  mosi_pin: GPIO6
-  cs_pin: GPIO19
-
-packages:
-  spi: !include ../../test_build_components/common/spi/esp32-s3-idf.yaml
-  uart_bridge_4: !include ../../test_build_components/common/uart_bridge_4/esp32-s3-idf.yaml
-
-<<: !include common.yaml

tests/integration/fixtures/wait_until_on_boot.yaml

@@ -0,0 +1,47 @@
+# Test for wait_until in on_boot automation
+# Reproduces bug where wait_until in on_boot would hang forever
+# because WaitUntilAction::setup() would disable_loop() after
+# play_complex() had already enabled it.
+
+esphome:
+  name: wait-until-on-boot
+  on_boot:
+    then:
+      - logger.log: "on_boot: Starting wait_until test"
+      - globals.set:
+          id: on_boot_started
+          value: 'true'
+      - wait_until:
+          condition:
+            lambda: return id(test_flag);
+          timeout: 5s
+      - logger.log: "on_boot: wait_until completed successfully"
+
+host:
+
+logger:
+  level: DEBUG
+
+globals:
+  - id: on_boot_started
+    type: bool
+    initial_value: 'false'
+  - id: test_flag
+    type: bool
+    initial_value: 'false'
+
+api:
+  actions:
+    - action: set_test_flag
+      then:
+        - globals.set:
+            id: test_flag
+            value: 'true'
+    - action: check_on_boot_started
+      then:
+        - lambda: |-
+            if (id(on_boot_started)) {
+              ESP_LOGI("test", "on_boot has started");
+            } else {
+              ESP_LOGI("test", "on_boot has NOT started");
+            }

tests/integration/test_wait_until_on_boot.py

@@ -0,0 +1,91 @@
+"""Integration test for wait_until in on_boot automation.
+
+This test validates that wait_until works correctly when triggered from on_boot,
+which runs at the same setup priority as WaitUntilAction itself. This was broken
+before the fix because WaitUntilAction::setup() would unconditionally disable_loop(),
+even if play_complex() had already been called and enabled the loop.
+
+The bug: on_boot fires during StartupTrigger::setup(), which calls WaitUntilAction::play_complex()
+before WaitUntilAction::setup() has run. Then when WaitUntilAction::setup() runs, it calls
+disable_loop(), undoing the enable_loop() from play_complex(), causing wait_until to hang forever.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import re
+
+import pytest
+
+from .types import APIClientConnectedFactory, RunCompiledFunction
+
+
+@pytest.mark.asyncio
+async def test_wait_until_on_boot(
+    yaml_config: str,
+    run_compiled: RunCompiledFunction,
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """Test that wait_until works in on_boot automation with a condition that becomes true later."""
+    loop = asyncio.get_running_loop()
+
+    on_boot_started = False
+    on_boot_completed = False
+
+    on_boot_started_pattern = re.compile(r"on_boot: Starting wait_until test")
+    on_boot_complete_pattern = re.compile(r"on_boot: wait_until completed successfully")
+
+    on_boot_started_future = loop.create_future()
+    on_boot_complete_future = loop.create_future()
+
+    def check_output(line: str) -> None:
+        """Check log output for test progress."""
+        nonlocal on_boot_started, on_boot_completed
+
+        if on_boot_started_pattern.search(line):
+            on_boot_started = True
+            if not on_boot_started_future.done():
+                on_boot_started_future.set_result(True)
+
+        if on_boot_complete_pattern.search(line):
+            on_boot_completed = True
+            if not on_boot_complete_future.done():
+                on_boot_complete_future.set_result(True)
+
+    async with (
+        run_compiled(yaml_config, line_callback=check_output),
+        api_client_connected() as client,
+    ):
+        # Wait for on_boot to start
+        await asyncio.wait_for(on_boot_started_future, timeout=10.0)
+        assert on_boot_started, "on_boot did not start"
+
+        # At this point, on_boot is blocked in wait_until waiting for test_flag to become true
+        # If the bug exists, wait_until's loop is disabled and it will never complete
+        # even after we set the flag
+
+        # Give a moment for setup to complete
+        await asyncio.sleep(0.5)
+
+        # Now set the flag that wait_until is waiting for
+        _, services = await client.list_entities_services()
+        set_flag_service = next(
+            (s for s in services if s.name == "set_test_flag"), None
+        )
+        assert set_flag_service is not None, "set_test_flag service not found"
+
+        client.execute_service(set_flag_service, {})
+
+        # If the fix works, wait_until's loop() will check the condition and proceed
+        # If the bug exists, wait_until is stuck with disabled loop and will timeout
+        try:
+            await asyncio.wait_for(on_boot_complete_future, timeout=2.0)
+            assert on_boot_completed, (
+                "on_boot wait_until did not complete after flag was set"
+            )
+        except TimeoutError:
+            pytest.fail(
+                "wait_until in on_boot did not complete within 2s after condition became true. "
+                "This indicates the bug where WaitUntilAction::setup() disables the loop "
+                "after play_complex() has already enabled it."
+            )