Thanks! The private endpoint tip is very much on point. We've already hit two prospects where the blocker was that they don't want full self-host but their security groups won't take generic cloud egress. It's on the list.