diff --git a/agent_api/build.gradle b/agent_api/build.gradle
index b0f758f1..96c01bb2 100644
--- a/agent_api/build.gradle
+++ b/agent_api/build.gradle
@@ -46,7 +46,6 @@ dependencies {
 test {
     jvmArgs '--add-opens', 'java.base/java.util=ALL-UNNAMED'
     jvmArgs '--add-opens', 'java.base/java.lang=ALL-UNNAMED'
-    jvmArgs "-javaagent:${project.rootDir}/dist/agent.jar=mode=daemon-disabled"
     jvmArgs '-Dnet.bytebuddy.experimental=true' // Mockito support.
 
     systemProperty 'AIK_agent_dir', "${project.rootDir}/dist"
@@ -64,6 +63,13 @@ test {
     jacoco {
         enabled = true
     }
+    doFirst {
+        // JaCoCo's javaagent must load before our own agent.jar. Our agent registers a
+        // retransformation-capable ByteBuddy transformer; if it loads first, JaCoCo silently
+        // stops recording coverage for almost every class, not just the ones we instrument.
+        jvmArgs jacoco.getAsJvmArg(), "-javaagent:${project.rootDir}/dist/agent.jar=mode=daemon-disabled"
+        jacoco.enabled = false
+    }
 }
 
 jacocoTestReport {
diff --git a/agent_api/src/main/java/dev/aikido/agent_api/helpers/net/IPList.java b/agent_api/src/main/java/dev/aikido/agent_api/helpers/net/IPList.java
index 0d1fde97..01813d51 100644
--- a/agent_api/src/main/java/dev/aikido/agent_api/helpers/net/IPList.java
+++ b/agent_api/src/main/java/dev/aikido/agent_api/helpers/net/IPList.java
@@ -2,15 +2,13 @@
 
 import inet.ipaddr.IPAddress;
 import inet.ipaddr.IPAddressString;
-
-import java.util.HashSet;
-import java.util.Set;
+import inet.ipaddr.format.util.DualIPv4v6Tries;
 
 public class IPList {
-    private Set<IPAddress> ipAddresses;
+    private final DualIPv4v6Tries ipAddresses;
 
     public IPList() {
-        this.ipAddresses = new HashSet<>();
+        this.ipAddresses = new DualIPv4v6Tries();
     }
 
     public void add(String ipOrCIDR) {
@@ -56,12 +54,7 @@ public boolean matches(String ip) {
     }
 
     private boolean containsAddress(IPAddress ipAddress) {
-        for (IPAddress subnet : ipAddresses) {
-            if (subnet.contains(ipAddress)) {
-                return true;
-            }
-        }
-        return false;
+        return ipAddresses.elementContains(ipAddress);
     }
     public int length() {
         return ipAddresses.size();