diff --git a/libcontainer/criu_linux.go b/libcontainer/criu_linux.go
index a86e53fd7..fb435e111 100644
--- a/libcontainer/criu_linux.go
+++ b/libcontainer/criu_linux.go
@@ -15,6 +15,7 @@ import (
 	"reflect"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/checkpoint-restore/go-criu/v7"
 	criurpc "github.com/checkpoint-restore/go-criu/v7/rpc"
@@ -183,7 +184,19 @@ func (c *Container) criuSupportsExtNS(t configs.NamespaceType) bool {
 }
 
 func criuNsToKey(t configs.NamespaceType) string {
-	return "extRoot" + strings.Title(configs.NsName(t)) + "NS" //nolint:staticcheck // SA1019: strings.Title is deprecated
+	// Construct "extRoot" + capitalize(nsName) + "NS" without allocations.
+	// Result format: "extRootNetNS", "extRootPidNS", etc.
+	nsName := configs.NsName(t)
+	out := make([]byte, 0, 32)
+	out = append(out, "extRoot"...)
+	// Capitalize the first character (this assumes it's in the a-z range).
+	if len(nsName) > 0 {
+		out = append(out, byte(unicode.ToUpper(rune(nsName[0]))))
+		out = append(out, nsName[1:]...)
+	}
+	out = append(out, "NS"...)
+
+	return string(out)
 }
 
 func (c *Container) handleCheckpointingExternalNamespaces(rpcOpts *criurpc.CriuOpts, t configs.NamespaceType) error {