How to make Cache Tagging work with FOSHttpCacheBundle and Varnish?

I configured Symfony and FOSHttpCacheBundle (following the Varnish configuration instructions in the FOSHttpCache documentation).

I added an action to my controller that adds a test tag in the response HTTP header:

<?php

use FOS\HttpCacheBundle\Configuration\Tag;

class MyController extends Controller
{
    /**
     * @Route("/test1", name="acme_my_test1")
     * @Tag("test")
     */
    public function test1Action()
    {
        return new Response(rand(0, 1000));
    }
}

However, whenever I call the /test1 URL, the number changes, showing the cache is not active. Note that my application doesn't use any cookie and I could test that the X-Cache-Tags header is sent to Varnish (which strips it in its response to the browser, thanks to the vlc_deliver directive).

Is there anything that I would have missed in the configuration? Both Varnish and Nginx run on the same server.

Here is the configuration related to HTTP cache in my Symfony config.yml file:

framework:
    trusted_hosts:   ~
    trusted_proxies:  [127.0.0.1]

fos_http_cache:
    proxy_client:
        varnish:
            servers: 127.0.0.1:80
            base_url: mywebsite.localhost.com
    tags:
        enabled: true

And Varnish configuration in /etc/varnish/default.vcl:

vcl 4.0;

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

acl invalidators {
    "localhost";
}

sub vcl_recv {
    if (req.http.X-Forwarded-Proto == "https" ) {
        set req.http.X-Forwarded-Port = "443";
    } else {
        set req.http.X-Forwarded-Port = "80";
    }

    set req.http.Surrogate-Capability = "abc=ESI/1.0";

    if (req.method == "PURGE") {
        if (!client.ip ~ invalidators) {
            return (synth(405, "Not allowed"));
        }
        return (purge);
    }

    if (req.http.Cache-Control ~ "no-cache" && client.ip ~ invalidators) {
        set req.hash_always_miss = true;
    }

    if (req.method == "BAN") {
        if (!client.ip ~ invalidators) {
            return (synth(405, "Not allowed"));
        }

        if (req.http.X-Cache-Tags) {
            ban("obj.http.X-Host ~ " + req.http.X-Host
                + " && obj.http.X-Url ~ " + req.http.X-Url
                + " && obj.http.content-type ~ " + req.http.X-Content-Type
                + " && obj.http.X-Cache-Tags ~ " + req.http.X-Cache-Tags
            );
        } else {
            ban("obj.http.X-Host ~ " + req.http.X-Host
                + " && obj.http.X-Url ~ " + req.http.X-Url
                + " && obj.http.content-type ~ " + req.http.X-Content-Type
            );
        }

        return (synth(200, "Banned"));
    }
}

sub vcl_backend_response {
    set beresp.http.X-Url = bereq.url;
    set beresp.http.X-Host = bereq.http.host;

    if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
        unset beresp.http.Surrogate-Control;
        set beresp.do_esi = true;
    }
}

sub vcl_deliver {
    if (!resp.http.X-Cache-Debug) {
        unset resp.http.X-Url;
        unset resp.http.X-Host;
        unset resp.http.X-Cache-Tags;
    }
}