Cloudflare Tunnel + Nextcloud results in 403 Forbidden when accessing via (sub) domain

I’m running Nextcloud locally on my OMV server (on port 80) and want to expose it externally via a Cloudflare Tunnel using my own subdomain without using port forwarding.

The Cloudflared tunnel is active, DNS is set correctly (CNAME pointing to <tunnelid>.cfargotunnel.com, proxy status enabled), and the config.yml points to localhost:80.

When accessing Nextcloud internally (curl localhost), everything works as expected and I get the Nextcloud page. However, accessing it externally via the domain results in a 403 Forbidden error from Nginx.

Trusted domains are configured, Cloudflare SSL is active, and the tunnel shows active (running).
Has anyone successfully set up Nextcloud behind a Cloudflare Tunnel without port forwarding and fixed this 403 issue?