AI Threat Detection Breaks Steam Checkout

Really not too much to say here. I have *.steampowered.com in my allowlist, and the checkout button sends a GET to checkout.steampowered.com. The logs show nothing blocked, but the request fails. If I disable AI Threat Detection, the request goes through.