diff --git a/markbase-core/src/ssh_server/channel.rs b/markbase-core/src/ssh_server/channel.rs
index b84f473..3305d4a 100644
--- a/markbase-core/src/ssh_server/channel.rs
+++ b/markbase-core/src/ssh_server/channel.rs
@@ -1213,7 +1213,8 @@ impl ChannelManager {
         use std::os::unix::io::{AsRawFd, BorrowedFd};
 
         // 收集所有需要poll的fd
-        let mut poll_fds_vec = Vec::new();
+        // Phase 3: 预分配 poll_fds_vec（避免频繁扩容）
+        let mut poll_fds_vec = Vec::with_capacity(self.channels.len() * 3 + 1); // 最多 (channels * 3) + client fd
         let mut client_has_data = false;
         let mut child_exited = false;
 
@@ -1660,7 +1661,8 @@ impl ChannelManager {
         use std::os::unix::io::BorrowedFd;
 
         // 遍历所有channel，收集poll_fds
-        let mut poll_fds_vec = Vec::new();
+        // Phase 3: 预分配 poll_fds_vec（避免频繁扩容）
+        let mut poll_fds_vec = Vec::with_capacity(self.channels.len() * 2); // 最多 channels * 2 (stdout + stderr)
         let mut channel_fds_map: HashMap<u32, (usize, usize)> = HashMap::new(); // channel_id -> (stdout_idx, stderr_idx) in poll_fds_vec
 
         for (channel_id, channel) in &self.channels {
diff --git a/markbase-core/src/ssh_server/cipher.rs b/markbase-core/src/ssh_server/cipher.rs
index c2a5f69..e3fa05d 100644
--- a/markbase-core/src/ssh_server/cipher.rs
+++ b/markbase-core/src/ssh_server/cipher.rs
@@ -703,7 +703,8 @@ impl EncryptedPacket {
             let payload_part2 = &remaining_encrypted[..payload_part2_len];
 
             // 合并payload
-            let mut payload = Vec::new();
+            // Phase 3: 预分配 payload Vec（避免扩容）
+            let mut payload = Vec::with_capacity(payload_length);
             payload.extend_from_slice(payload_part1);
             payload.extend_from_slice(payload_part2);