# UNDF: UNDF-2026-000000750
# UNDF: (leave blank)
--- a/server/reload.go
+++ b/server/reload.go
@@ -2605,26 +2605,27 @@ func diffProxiesTrustedKeys(old, new []*ProxyConfig) ([]string, []string) {
 // diffRoutes diffs the old routes and the new routes and returns the ones that
 // should be added and removed from the server.
 func diffRoutes(old, new []*url.URL) (add, remove []*url.URL) {
-	// Find routes to remove.
-removeLoop:
-	for _, oldRoute := range old {
-		for _, newRoute := range new {
-			if urlsAreEqual(oldRoute, newRoute) {
-				continue removeLoop
-			}
+	// Build O(1)-lookup sets from each list's canonical URL strings.
+	// This replaces two O(R²) nested loops with two O(R) passes.
+	newSet := make(map[string]struct{}, len(new))
+	for _, u := range new {
+		if u != nil {
+			newSet[u.String()] = struct{}{}
 		}
-		remove = append(remove, oldRoute)
 	}
-
-	// Find routes to add.
-addLoop:
-	for _, newRoute := range new {
-		for _, oldRoute := range old {
-			if urlsAreEqual(oldRoute, newRoute) {
-				continue addLoop
-			}
+	oldSet := make(map[string]struct{}, len(old))
+	for _, u := range old {
+		if u != nil {
+			oldSet[u.String()] = struct{}{}
 		}
-		add = append(add, newRoute)
 	}

+	for _, oldRoute := range old {
+		if oldRoute != nil {
+			if _, found := newSet[oldRoute.String()]; !found {
+				remove = append(remove, oldRoute)
+			}
+		}
+	}
+	for _, newRoute := range new {
+		if newRoute != nil {
+			if _, found := oldSet[newRoute.String()]; !found {
+				add = append(add, newRoute)
+			}
+		}
+	}
 	return add, remove
 }