WireGuard on both HA/CARP nodes causes remote peer roaming — best way to toggle tunnel via rc.carpmaster/rc.carpbackup?

[PF_Man]

Hi Guys!!

I have a pfSense Plus HA pair (CARP), 25.07.1, upgrading to 26.03.1 soon.

We have a WireGuard tunnel (3 peers) with identical config, including the same keypair, synced to both HA nodes. All peers connect to our CARP VIP, with Persistent Keepalive (25s) on both sides.

Since both nodes run WireGuard simultaneously with the same public key, the remote peers' endpoint tracking ("roaming") flips between our two real WAN IPs. This causes our gateway monitoring to show intermittent packet loss on whichever node is BACKUP, though actual traffic keeps flowing fine (confirmed via WireGuard status and states table).

Disabling WG entirely on the BACKUP node fixes the monitoring, but then the tunnel starts "cold" on a real failover — no live handshake — which is what the keepalive was meant to prevent.

What we want: only enable/run the WireGuard tunnel on the current CARP MASTER, toggled via rc.carpmaster/rc.carpbackup on the normally-BACKUP node.

Questions:

Correct/supported way to enable/disable a WireGuard tunnel interface from rc.carpmaster/rc.carpbackup on 26.03.1 (not just raw ifconfig)?
Best way to persist this across firmware upgrades (System Patches package)?
Is there a known best-practice pattern for WireGuard on active/passive CARP that avoids this roaming issue — e.g. separate keypair per node with two peer entries on the remote side?

Any pointers appreciated.