It was caused by an incorrect DestinationRule I wasn't thinking of:

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  labels:
    app: application
  name: application
  namespace: application-customer
spec:
  host: application
  subsets:
  - labels:
      app: application
    name: default

(the host should be application.customer.ocs.nu, not just application).