Your company deploys an Azure Virtual WAN with a single virtual hub. A branch is connected to the hub via both an ExpressRoute circuit (private peering) and a Site-to-Site VPN for redundancy. The same on-premises prefixes are advertised over both paths using BGP. You want the virtual hub to prefer the Site-to-Site VPN path over ExpressRoute for traffic destined to on-premises, without changing on-premises BGP attributes or removing either connection. What should you configure?