diff --git a/Cargo.lock b/Cargo.lock
index aa72fe2b..f15e7f82 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3977,6 +3977,7 @@ name = "techscript_package_manager"
 version = "2.0.0"
 dependencies = [
  "anyhow",
+ "criterion",
  "serde",
  "serde_json",
  "toml 1.1.4+spec-1.1.0",
diff --git a/tools/package-manager/Cargo.toml b/tools/package-manager/Cargo.toml
index b891de41..19c89e09 100644
--- a/tools/package-manager/Cargo.toml
+++ b/tools/package-manager/Cargo.toml
@@ -10,3 +10,10 @@ serde_json = { workspace = true }
 toml = "1.1"
 anyhow = { workspace = true }
 ureq = { version = "2.9" }
+
+[[bench]]
+name = "capability_validation_bench"
+harness = false
+
+[dev-dependencies]
+criterion = "0.8.2"
diff --git a/tools/package-manager/benches/capability_validation_bench.rs b/tools/package-manager/benches/capability_validation_bench.rs
new file mode 100644
index 00000000..ce74d3e7
--- /dev/null
+++ b/tools/package-manager/benches/capability_validation_bench.rs
@@ -0,0 +1,29 @@
+use criterion::{criterion_group, criterion_main, Criterion};
+use std::hint::black_box;
+use techscript_package_manager::CapabilityValidator;
+
+fn benchmark_validate_elevation(c: &mut Criterion) {
+    let mut group = c.benchmark_group("capability_validation");
+
+    let root_caps: Vec<String> = (0..100).map(|i| format!("cap_{}", i)).collect();
+    let dep_caps: Vec<String> = (50..150).map(|i| format!("cap_{}", i)).collect();
+    let allowed_elevations: Vec<String> = (0..100).map(|i| format!("dep_{}", i)).collect();
+
+    let dep_name = "dep_50"; // Will be found in allowed_elevations
+
+    group.bench_function("validate_elevation", |b| {
+        b.iter(|| {
+            let _ = CapabilityValidator::validate_elevation(
+                black_box(&root_caps),
+                black_box(&dep_caps),
+                black_box(&allowed_elevations),
+                black_box(dep_name),
+            );
+        });
+    });
+
+    group.finish();
+}
+
+criterion_group!(benches, benchmark_validate_elevation);
+criterion_main!(benches);
diff --git a/tools/package-manager/src/lib.rs b/tools/package-manager/src/lib.rs
index 6debbdfc..f6b03271 100644
--- a/tools/package-manager/src/lib.rs
+++ b/tools/package-manager/src/lib.rs
@@ -340,8 +340,10 @@ impl CapabilityValidator {
         dep_name: &str,
     ) -> Result<()> {
         let root_set: HashSet<&String> = root_caps.iter().collect();
+        let allowed_elevations_set: HashSet<&str> =
+            allowed_elevations.iter().map(|s| s.as_str()).collect();
         for cap in dependency_caps {
-            if !root_set.contains(cap) && !allowed_elevations.contains(&dep_name.to_string()) {
+            if !root_set.contains(cap) && !allowed_elevations_set.contains(dep_name) {
                 return Err(anyhow!(
                     "Security validation failed: Dependency '{}' requests capability '{}' which is not granted to the parent package.",
                     dep_name,