aws:SourceIp after adding a VPC endpoint

This bucket policy worked while instances reached S3 through a NAT gateway with public IP 203.0.113.10. After an S3 gateway endpoint was added, every request is denied. Why?

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": "arn:aws:s3:::data/*",
  "Condition": { "NotIpAddress": { "aws:SourceIp": "203.0.113.0/24" } }
}