Strategies to avoid 'SASE Hairpin' issue for same-site users on Cloudflare?

We're looking at migrating to CloudFlare SASE (as a replacement for Forcepoint's SASE product that hasn't quite kept up).

Most of the functionality we want seems to be present, with one exception: how to handle users on the same site as resources without either sending all the traffic on a round-trip to cloud (adding latency, congesting WAN bandwidth) or just disabling all access controls (losing zero trust benefit). Not a huge issue with orgs that are all in on SaaS/Webapps, but we have a fair bit of on prem thick apps and similar that aren't as flexible.

CloudFlare is one of the few vendors with PoPs near us, but since they don't (AFAIK) offer appliances for on-prem enforcement, I'm not sure if there is a workable solution to this.

I'm sure we're not the only ones hitting this 'quirk', and its common with a few other SASE vendors aswell - has anyone come up with a good work around or reference architecture?