A VPN-dependent application keeps failing on boot

The interface is up, yet the policy-routing state the application depends on appears after the service has already made its first connections.