I've never used #OpenBSD's rdomain(4) feature in anger before but I just configured it to ensure all traffic from a specific VLAN exits via a WireGuard tunnel. It's a really elegant solution and foolproof for those cases where you don't ever want traffic exiting via any other route (eg, if the tunnel interface is destroyed).

https://man.openbsd.org/rdomain.4

Not the same as my setup but @solene has a useful guide - https://dataswamp.org/~solene/2021-10-09-openbsd-wireguard-exit.html