JWT auth fails when adding custom domain

{"code": 5, "message": "Not Found"}

zitadel-tools key2jwt \
  --audience=https://zitadel.domain.com \
  --key=system-user-1.pem \
  --issuer=system-user-1

curl --request POST \
  --url https://zitadel.domain.com/system/v1/instances/_search \
  --header 'Authorization: Bearer ey...' \
  --header 'Content-Type: application/json'

{
  "code": 16,
  "message": "Errors.Token.Invalid (AUTH-7fs1e)"
}