This took multiple days to figure out, which is slightly embarrassing. I’m documenting the solution here to hopefully save you some time.