diff --git a/src/libnm-client-impl/libnm.ver b/src/libnm-client-impl/libnm.ver
index 1fb3282d82..92183be2b3 100644
--- a/src/libnm-client-impl/libnm.ver
+++ b/src/libnm-client-impl/libnm.ver
@@ -2090,4 +2090,5 @@ global:
 	nm_setting_gsm_get_device_uid;
 	nm_setting_connection_get_dnssec;
 	nm_setting_connection_dnssec_get_type;
+	nm_vpn_plugin_info_supports_safe_private_file_access;
 } libnm_1_54_0;
diff --git a/src/libnm-core-impl/nm-vpn-plugin-info.c b/src/libnm-core-impl/nm-vpn-plugin-info.c
index 223d8ab33b..47dc9e3b5a 100644
--- a/src/libnm-core-impl/nm-vpn-plugin-info.c
+++ b/src/libnm-core-impl/nm-vpn-plugin-info.c
@@ -913,6 +913,29 @@ nm_vpn_plugin_info_supports_multiple(NMVpnPluginInfo *self)
     return _nm_utils_ascii_str_to_bool(s, FALSE);
 }
 
+/**
+ * nm_vpn_plugin_info_supports_safe_private_file_access:
+ * @self: plugin info instance
+ *
+ * Returns: %TRUE if the service supports reading files (certificates, keys) of
+ *     private connections in a safe way (i.e. checking user permissions), or
+       if the service doesn't need to read any file from disk.
+ *
+ * Since: 1.56
+ */
+gboolean
+nm_vpn_plugin_info_supports_safe_private_file_access(NMVpnPluginInfo *self)
+{
+    const char *s;
+
+    g_return_val_if_fail(NM_IS_VPN_PLUGIN_INFO(self), FALSE);
+
+    s = nm_vpn_plugin_info_lookup_property(self,
+                                           NM_VPN_PLUGIN_INFO_KF_GROUP_CONNECTION,
+                                           "supports-safe-private-file-access");
+    return _nm_utils_ascii_str_to_bool(s, FALSE);
+}
+
 /**
  * nm_vpn_plugin_info_get_aliases:
  * @self: plugin info instance
diff --git a/src/libnm-core-public/nm-vpn-plugin-info.h b/src/libnm-core-public/nm-vpn-plugin-info.h
index c045daa03d..0f2618ac9a 100644
--- a/src/libnm-core-public/nm-vpn-plugin-info.h
+++ b/src/libnm-core-public/nm-vpn-plugin-info.h
@@ -64,6 +64,8 @@ NM_AVAILABLE_IN_1_4
 gboolean nm_vpn_plugin_info_supports_hints(NMVpnPluginInfo *self);
 NM_AVAILABLE_IN_1_42
 gboolean nm_vpn_plugin_info_supports_multiple(NMVpnPluginInfo *self);
+NM_AVAILABLE_IN_1_56
+gboolean nm_vpn_plugin_info_supports_safe_private_file_access(NMVpnPluginInfo *self);
 NM_AVAILABLE_IN_1_4
 const char *const *nm_vpn_plugin_info_get_aliases(NMVpnPluginInfo *self);
 NM_AVAILABLE_IN_1_2