Moments after posting this I realized one of the targets was on the wrong security group. It seems the right fix was to use the ingress rule.