So the way I got it working for me was by forcing the cloudflared daemon to use the quic protocol instead of http2. Also, I haven’t tested this but it doesn’t hurt to enable Websockets under Websites → <domain> → Network:
protocol: quic
tunnel: <redacted>
credentials-file: /etc/cloudflared/<redacted>.json
ingress:
- hostname: incus.example.xyz
service: unix:/var/lib/incus/unix.socket
- service: http_status:404
OR
cloudflared tunnel --protocol quic run