diff --git a/.github/workflows/docker-development.yml b/.github/workflows/docker-development.yml
index ae4c984..e43ad22 100644
--- a/.github/workflows/docker-development.yml
+++ b/.github/workflows/docker-development.yml
@@ -27,5 +27,7 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
       - run: pip install -r requirements-dev.txt
       - run: python -m pytest tests/test_dev_compose_linux.py -m docker -v
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index d741fd5..042613c 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -1,7 +1,9 @@
 name: Validate
 
 on:
+  # Branches are checked through their PR; a push of its own only on main.
   push:
+    branches: [main]
   pull_request:
   merge_group:
   schedule:
@@ -19,14 +21,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: home-assistant/actions/hassfest@master
+      - uses: home-assistant/actions/hassfest@cd6f3635a740c84d8a14f6121a90068b8ece6bf6  # master, 17/10/2026
 
   hacs:
     name: HACS
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: hacs/action@main
+      - uses: hacs/action@1ebf01c408f29afcb6406bd431bc98fd8cbb15aa  # main, 08/06/2026
         with:
           category: integration
 
@@ -38,9 +40,9 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
-      # Pinned so that a new ruff release cannot turn the CI red on its own;
-      # bump it on purpose together with the fixes it asks for.
-      - run: pip install ruff==0.16.10
+      # Pinned in requirements-dev.txt, so the CI and /check run the same ruff:
+      # a new release cannot turn the CI red on its own.
+      - run: pip install "$(grep '^ruff==' requirements-dev.txt)"
       - run: ruff check .
 
   tests:
@@ -55,6 +57,8 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
       - run: pip install -r requirements-dev.txt
       # I test girano senza Home Assistant installato: conftest.py fornisce gli
       # stub. I test marcati `live` (che richiedono il citofono in rete) sono
@@ -75,6 +79,8 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
       - run: sudo apt-get update && sudo apt-get install -y ffmpeg
       - run: pip install -r requirements-dev.txt aiohttp playwright
       - run: python -m playwright install --with-deps chromium
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 700e7db..dc4acdf 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,10 +1,10 @@
-pytest>=9.1.1
-pytest-cov>=7.1.0
-ruff>=0.16.10
-pycryptodome>=3.23.0
-requests>=2.34.2
-cryptography>=50.0.2
-pyyaml>=6.0.3
-HAP-python>=5.0.0
-PyQRCode>=1.2.1
-base36>=0.1.1
+pytest==9.1.1
+pytest-cov==7.1.0
+ruff==0.16.10
+pycryptodome==4.1.0
+requests==2.34.2
+cryptography==50.0.2
+pyyaml==6.0.3
+HAP-python==5.0.0
+PyQRCode==1.2.1
+base36==0.1.1
diff --git a/tests/test_ci_pins.py b/tests/test_ci_pins.py
new file mode 100644
index 0000000..4ef9ca0
--- /dev/null
+++ b/tests/test_ci_pins.py
@@ -0,0 +1,32 @@
+"""The CI runs fixed versions: a new release of a tool or an action cannot turn it red on its own.
+Dependabot (.github/dependabot.yml) moves them, once a month, in a PR of its own."""
+from __future__ import annotations
+
+import pathlib
+import re
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+WORKFLOWS = sorted((ROOT / ".github" / "workflows").glob("*.yml"))
+
+
+def test_no_workflow_follows_a_branch_of_an_action():
+    moving = [f"{w.name}: {m}" for w in WORKFLOWS
+              for m in re.findall(r"uses:\s*(\S+@(?:main|master))", w.read_text(encoding="utf-8"))]
+    assert moving == []
+
+
+def test_the_dev_tools_are_pinned_exactly():
+    lines = [ln.strip() for ln in (ROOT / "requirements-dev.txt").read_text(encoding="utf-8").splitlines()]
+    assert [ln for ln in lines if ln and not ln.startswith("#") and "==" not in ln] == []
+
+
+def test_the_ruff_job_takes_its_version_from_requirements_dev():
+    validate = (ROOT / ".github" / "workflows" / "validate.yml").read_text(encoding="utf-8")
+    assert "requirements-dev.txt" in validate.split("ruff check")[0].rsplit("name: ruff", 1)[1]
+    assert not re.search(r"pip install ruff==", validate)
+
+
+def test_a_branch_push_does_not_run_the_ci_twice():
+    validate = (ROOT / ".github" / "workflows" / "validate.yml").read_text(encoding="utf-8")
+    on = validate.split("\non:", 1)[1].split("\npermissions:", 1)[0]
+    assert re.search(r"push:\s*\n\s*branches:\s*\[main\]", on)