This turned out to be something on my end, but leads to a question about how the behavior of the app should be.
I did some digging, turned out this was due to some certs or something on my home router that didn’t like sh.itjust.works. The web interface shows a lemmy.world mirror of the image, but Boost shows the image from the original post on sh.itjust.works.
The question is, should the app be pulling from the original source? If that source instance goes down, Boost won’t be able to show it anymore. That seems against the philosophy of the Fediverse (and the actual Lemmy website shows the mirror).