Anyone get Immich Android app working with self-signed HTTPS certs?

I'm running Immich on my local network under the *.home.lan domain (not publicly accessible). My mobile devices connect over Wi-Fi, and I use OPNsense as my firewall. I've created my own internal CA and issued certificates (e.g., immich.home.lan). Nginx acts as a reverse proxy to upgrade HTTP to HTTPS. Everything works perfectly, in browsers https://immich.home.lan loads fine.

Before setting up Nginx, the Immich Android app worked using http://immich.home.lan:2283 Now that I use HTTPS, the app complains about the self-signed cert

Invalid SSL certificate for immich.home.lan:443

ApiException 400: TLS/SSL communication failed: GET /server/ping (Inner exception: HandshakeException: Handshake error in client (OS Error:

CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate(handshake.cc:391)))
#0 _SecureFilterImpl._handshake (dart:io-patch/secure_socket_patch.dart:102)
#1 _SecureFilterImpl.handshake (dart:io-patch/secure_socket_patch.dart:147)
#2 _RawSecureSocket._secureHandshake (dart:io/secure_socket.dart:1009)
#3 _RawSecureSocket._tryFilter (dart:io/secure_socket.dart:1141)
<asynchronous suspension>

My internal CA is correctly installed on the Android device, and other *.home.lan sites work just fine in Chrome and other apps. I also tried using a certificate chain (including ca certificate). Anyone else run into this with the Immich Android app? Any known fixes or workarounds?