Use the self-signed cert between the proxy and the problem device; everything else talks to the proxy.
Or Wireguard.
Using VPNs on server infrastructure to punch a hole is a resume generating event.
Wireguard is not a VPN, it’s a protocol that can be used for a lot of things.
We used to use Firefox solely for internal problem devices with IP and subnet exclusions but even that is becoming difficult.