diff --git a/appguardrail_core/rules.py b/appguardrail_core/rules.py
index 87180a8..9434199 100644
--- a/appguardrail_core/rules.py
+++ b/appguardrail_core/rules.py
@@ -90,12 +90,13 @@ def as_dict(self) -> dict[str, Any]:
 
 def extract_public_references(message: str) -> tuple[str, ...]:
     """Extract OWASP, CWE, and CVE references already embedded in rule copy."""
-    seen: list[str] = []
-    for match in REFERENCE_RE.finditer(message or ""):
-        reference = " ".join(match.group(1).split())
-        if reference not in seen:
-            seen.append(reference)
-    return tuple(seen)
+    # ⚡ Bolt: Optimize list deduplication using dict.fromkeys for O(N) complexity
+    return tuple(
+        dict.fromkeys(
+            " ".join(match.group(1).split())
+            for match in REFERENCE_RE.finditer(message or "")
+        )
+    )
 
 
 def build_rule_metadata(
@@ -140,9 +141,9 @@ def validate_rule_metadata(metadata: RuleMetadata | dict[str, Any]) -> list[str]
 
 
 def _merge_references(*groups: tuple[str, ...]) -> tuple[str, ...]:
-    merged: list[str] = []
-    for group in groups:
-        for reference in group:
-            if reference and reference not in merged:
-                merged.append(reference)
-    return tuple(merged)
+    # ⚡ Bolt: Optimize list deduplication using dict.fromkeys for O(N) complexity
+    return tuple(
+        dict.fromkeys(
+            reference for group in groups for reference in group if reference
+        )
+    )