nginx-ingress 400 error with websockets

Trying to host an app, specifically Foundry VTT, on my k8s cluster. It connects fine, but websockets (any url starting with /socket.io/ are giving me a 400 error.

Googling how to enable websocket support, it seems I just need to add the proxy send/read timeout and set it to a higher value, which I did.

I've tried adding nginx.org/websocket-service annotation, but that didn't work.

Nginx version: Helm chart ingress-nginx-3.20.1; app version 0.43.0

My ingress.yml:

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: foundry
  labels:
    app: foundry
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/connection-proxy-header: "keep-alive"
    #nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: '30'
    nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
    nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
    nginx.ingress.kubernetes.io/client-max-body-size: 512M
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
spec:
  tls:
    - hosts:
        - rpg.example.com
      secretName: foundry-tls
  rules:
    - host: rpg.example.com
      http:
        paths:
          - path: /
            backend:
              serviceName: foundry
              servicePort: http