I have defined the following block for PHP:

location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php/php7.3-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_intercept_errors on;
        fastcgi_send_timeout 180;
        fastcgi_read_timeout 180;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        fastcgi_params;
        }

Whenever I attempt to define a location block to prevent access to wp-admin or wp-login.php, the PHP file is downloaded:

Root location:

location / {
                try_files $uri $uri/ /index.php?$args;
        }

and directly underneath that:

        location ~ ^/(wp-admin|wp-login\.php) {
               try_files $uri $uri/ /index.php?$args;
               allow xxx.xxx.xxx.xxx;
               allow xxx.xxx.xxx.xxx;
               deny all;
       }

I can’t for the life of me figure out why it’s bypassing PHP and downloading.