Can't deploy API management with private link to key vault

Question

So I have a hub and spoke network structure set up in azure, and on the spoke network I have a subnet dedicated for my API management which I am trying to deploy to via bicep file. Also linked to this same subnet are 2 private endpoints - one for a private link to azure key vault and another for a private link to azure container registry. The key vault private link is needed for the API management to access the certificates in key vault for the portal, gateway, and management backends, and then the container registry link will be needed for an AKS cluster deployment to pull images. I have the associated private DNS zones set up for both of these private endpoints, and on the subnet I have privateEndpointNetworkPolicies and privateLinkServiceNetworkPolicies both set to Disabled.

If I remove the private endpoints, the API management deployment works fine, but with the private endpoints added, I get the following error when trying to deploy the API management:

{
"status": "Failed",
"error": {
"code": "ResourceDeploymentFailure",
"message": "The resource operation completed with terminal provisioning state 'Failed'."
}
}

This isn't a whole lot of detail to go off of, and I've been struggling to figure out what the issue is here. Does anyone have any suggestions?