An app in a peered VPC reaches the replica database but not the primary

The app VPC (10.10.0.0/16) is peered with the data VPC (10.20.0.0/16) in us-east-1. The peering connection pcx-0c4d5e6f7a8b90123 shows Active. From APP1 (10.10.10.25), connections to the read replica DB2 (10.20.11.40, us-east-1b) work. Connections to the primary DB1 (10.20.10.40, us-east-1a) on port 5432 time out. Both databases use the same security group, which allows 5432 from 10.10.0.0/16.