Wireguard can't import tunnel on Sequoia

I installed the Wireguard App from the App Store (App version: 1.0.16 (27) Go backend version: 1e2c3e5a) on an M4 Mac mini.

It installed and runs without asking for any permissions but when I attempt to import a tunnel from a config file. I see the following error in the log:

[APP] Add: Saving configuration failed: Error Domain=NEVPNErrorDomain Code=5 "permission denied" UserInfo={NSLocalizedDescription=permission denied}

I have added "Full disk access" permission for Wireguard.app but this hasn't changed the error.

From searching I see that it might also need permission to add a VPN but I can't find that in Settings.

I've been using Wireguard successfully for several years on MacOS up to 13.7.

What do I need to do to make this work?