Large IPv6 downloads from HQ stall at the branch after a firewall change

Branch users reach the intranet server SRV1 at HQ over IPv6 through a GRE over IPsec tunnel between R1 and R2. Since last night's change window, small pages load but large pages and file downloads hang after a few seconds. The TLS handshake always completes. Over IPv4 everything works. The change was a "WAN hardening" IPv6 ACL, WAN-IN, applied inbound on CORE1's interface toward R2. Both tunnel ends have ipv6 mtu 1400 on Tunnel0. SRV1 is 2001:db8:200:10::20, PC1 is 2001:db8:100:10::50.