diff --git a/management/server/types/networkmap.go b/management/server/types/networkmap.go
index c85dac973..54ceb54d2 100644
--- a/management/server/types/networkmap.go
+++ b/management/server/types/networkmap.go
@@ -312,7 +312,7 @@ func (a *Account) validatePostureChecksOnPeer(ctx context.Context, sourcePosture
 
 // expandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules
 func expandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
-	var expanded []*FirewallRule
+	expanded := make([]*FirewallRule, 0, len(rule.Ports)+len(rule.PortRanges))
 
 	if len(rule.Ports) > 0 {
 		for _, port := range rule.Ports {