Jetstream/Inertia CSRF oddity

I've been helping out with some local development, trying out Jetstream and Inertia. Local development has been fairly smooth, and everything has for the most part just worked. However, we've thrown the app up on a server, and we're getting the dreaded 419 page expired error.

From what I can tell, the XSRF-TOKEN cookie exists in the response when loading the login page. However, the X-XSRF-TOKEN header is not getting appended when submitting login on the server. (everything works as expected locally) I will note we are using Apache on the server, whereas Valet uses nginx out of the box.

(using the standard Jetstream/Inertia/vue3 login view at present)

const form = useForm({
    email: '',
    password: '',
    remember: false,
});

const submit = () => {
    form.transform(data => ({
        ...data,
        remember: form.remember ? 'on' : '',
    })).post(route('login'), {
        onFinish: () => form.reset('password'),
    });
};

I saw some others reference a subdomain issue, causing the domain/origin to not match, and was hoping someone might know more about that subject.

I use Laravel Valet locally, so my local domain is similar to project.test. On the server, I'm using one of our play around .io domains, and the domain looks like project.domain.io.

The session or cookie domain are not being customized, outside of setting the APP_URL environment value. Flipping between the file and database session driver does not appear to make a difference.

Any advice or ideas of where to look would be greatly appreciated.