Istio Multi-master Multi-network Locality Failover Woes

I can't get "multi-primary multi-network" to play nice with locality failover (or locality load balancing for that matter). The endpoints are registered fine. The istio-system is labeled with network information, and each node is labeled with zone and region information and when I check the /clusters page on the client's envoy admin interface, the zone and region information is set correctly for each endpoint.

The issue seems to be that the control plane isn't assigning priority to the endpoints. However, to a stale source, this should work automatically, provided that I've created a DestinationRule (which I have). I've also crated a VirtualService for good measure.

$ istioctl proxy-config endpoints -n client client-6889f68cbc-z5jb6 --cluster "outbound|80||server.server.svc.cluster.local" -o json | jq '.[0].hostStatuses[] | del(.stats)'
{
  "address": {
    "socketAddress": {
      "address": "10.244.1.25",
      "portValue": 80
    }
  },
  "healthStatus": {
    "edsHealthStatus": "HEALTHY"
  },
  "weight": 1,
  "locality": {
    "region": "region2",
    "zone": "zone2"
  }
}
{
  "address": {
    "socketAddress": {
      "address": "172.18.254.1",
      "portValue": 15443
    }
  },
  "healthStatus": {
    "edsHealthStatus": "HEALTHY"
  },
  "weight": 3,
  "locality": {
    "region": "region1",
    "zone": "zone1"
  }
}

My setup is two 1.20.2 clusters running locally using KinD + metallb, with Istio operator v1.9.1. Each cluster is configured to occupy a different region & zone.

Istio VS and DR

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: server
  namespace: server
spec:
  host: server
  trafficPolicy:
    connectionPool:
      http:
        http2MaxRequests: 10
        maxRequestsPerConnection: 10
    loadBalancer:
      localityLbSetting:
        enabled: true
      simple: ROUND_ROBIN
    outlierDetection:
      baseEjectionTime: 1m
      consecutive5xxErrors: 1
      interval: 1s
      maxEjectionPercent: 51
      minHealthPercent: 0

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: server
  namespace: server
spec:
  hosts:
  - server
  http:
  - route:
    - destination:
        host: server

Kiali View

As you can see from the Kiali dashboard, the DR and VS are both active. Both clusters are routable. But traffic is flowing to both equally, where it ought to be flowing only to one. I've also tried specifying distribute and failover explicitly in my DR spec with no success.