Fabric Workspace Inbound Firewall – IPv6 client IP?

I have an interesting issue.

Our fabric setup has a tenant level private endpoint, but it is not required.

I have an Azure VM set up with limited internet access. It uses a tenant level private endpoint set up on the vnet.

It works great! I have to set up DNS records for non-http stuff since we're not using azure DNS, but it's fine.

Now I want to block access to a workspace so that it's only accessible by this VM.

I've tried doing the VM internal IP in addition to the entire subnet range (both in IP range mode and CIDR mode), and no matter what I cannot keep access.

Now for the strangeness:

I decided to just try the auto "add this client." Unfortunately it fills in an IPV6 address and I cannot click apply. It also doesn't fill in the IP address of my VM, which is extra special ….

Any ideas?