Letsencrypt challenge uses ipv6, even when disabled

[sbkg0002]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • No
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

Certbot uses an IPv6 address instead of IPv4. Since my network doesn't support IPv6, the challenge fails.

Nginx Proxy Manager Version

v2.15.1, image with sha256:f44e23f5e4d7d71dae4548e273b498c567311c76502a128f3bc782f528a58087

To Reproduce
Steps to reproduce the behavior:

My docker-compose.yaml:

services:
  app:
    container_name: nginx-proxy-manager
    image: 'jc21/nginx-proxy-manager:latest' # sha256:f44e23f5e4d7d71dae4548e273b498c567311c76502a128f3bc782f528a58087
    restart: unless-stopped
    environment:
      DISABLE_IPV6: 'true'
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

I see that the environment var is picked up:

$ docker compose logs | grep -i ipv
nginx-proxy-manager  | ❯ IPv6 ...
nginx-proxy-manager  | Disabling IPV6 in hosts in: /etc/nginx/conf.d
nginx-proxy-manager  | Disabling IPV6 in hosts in: /data/nginx

But the challenge still uses IPv6:

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Identifier: xxx.xxx.com
  Type:   unauthorized
  Detail: 2001:xxx:xxx:xxx::xxx: Invalid response from http://xxx.xxx.com/.well-known/acme-challenge/bIT8OpBsNGZJu7e1nimsVn5-teJWm5l3Snw6ebiy-l8: 204

Operating System

Latest Arch Linux
Docker version 28.5.2, build ecc694264d.

What am I missing here?