Whitelabelling: Default redirect URI not working for Organization?

Hello, we have a situation where we have

app.oursite.com -> Our app
login.app.oursite.com -> Our default login

ourapp.customer.com -> Cname to our app from customer
login.ourapp.customer.com -> Custom zitadel domain pointing at our app.

When our customers navigate directly to ourapp.customer.com they get correctly redirected to login.ourapp.customer.com with the org id etc set.

When our customers navigate directly to login.ourapp.customer.com they get redirected to app.oursite.com which in turn redirects to login.app.oursite.com .

We have set their verified domains to match

ourapp.customer.com
login.ourapp.customer.com

But using the cname value they aren't redirected to their organization's login page when hitting it directly? We have alsos set their orgnaization default redirct uri to ourapp.customer.com . Any idea how we can make zitadel undersatnd that the custom domain is in fact the one belonging to this organization (kind of the whole point of this whitelabelling!)