diff --git a/fix-vpn-config.patch b/fix-vpn-config.patch
new file mode 100644
index 0000000..1c82df3
--- /dev/null
+++ b/fix-vpn-config.patch
@@ -0,0 +1,74 @@
+From 6219cbdca5b807292ce53e8b6e46b7d52c1a9f62 Mon Sep 17 00:00:00 2001
+From: Michael Catanzaro <mcatanzaro@redhat.com>
+Date: Fri, 29 Sep 2023 11:36:07 -0500
+Subject: [PATCH] network: fix editing connections without a device
+
+For example, fix adding new VPN connections.
+
+In 60b4956c051f86d7c2e23b46990172a3efcd7435 I correctly observed that we
+need to not run code that requires a device when there is no device.
+NetConnectionEditor is a multipurpose dialog and self->device is
+optional when creating the dialog. E.g. when modifying VPN
+configuration, we update just the configuration, not an NMDevice.
+
+However, I added this check too soon, before updating the connection
+configuration. We need to update the configuration first, then only bail
+before proceeding to update the device, not sooner.
+
+Fix #2668
+---
+ .../connection-editor/net-connection-editor.c | 21 ++++++++++++-------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/panels/network/connection-editor/net-connection-editor.c b/panels/network/connection-editor/net-connection-editor.c
+index c51667f839..f97658405d 100644
+--- a/panels/network/connection-editor/net-connection-editor.c
++++ b/panels/network/connection-editor/net-connection-editor.c
+@@ -240,6 +240,12 @@ updated_connection_cb (GObject            *source_object,
+ 
+         nm_connection_clear_secrets (NM_CONNECTION (source_object));
+ 
++        if (!self->device) {
++                update_complete (self, TRUE);
++                g_object_unref (self);
++                return;
++        }
++
+         nm_device_reapply_async (self->device, NM_CONNECTION (self->orig_connection),
+                                  0, 0, NULL, device_reapply_cb, self /* owned */);
+ }
+@@ -251,12 +257,16 @@ added_connection_cb (GObject            *source_object,
+ {
+         NetConnectionEditor *self = user_data;
+         g_autoptr(GError) error = NULL;
+-        gboolean success = TRUE;
+ 
+         if (!nm_client_add_connection_finish (NM_CLIENT (source_object), res, &error)) {
+                 g_warning ("Failed to add connection: %s", error->message);
+-                success = FALSE;
+-                update_complete (self, success);
++                update_complete (self, FALSE);
++                g_object_unref (self);
++                return;
++        }
++
++        if (!self->device) {
++                update_complete (self, TRUE);
+                 g_object_unref (self);
+                 return;
+         }
+@@ -272,11 +282,6 @@ apply_clicked_cb (NetConnectionEditor *self)
+ 
+         eap_method_ca_cert_ignore_save (self->connection);
+ 
+-        if (!self->device) {
+-                update_complete (self, TRUE);
+-                return;
+-        }
+-
+         if (self->is_new_connection) {
+                 nm_client_add_connection_async (self->client,
+                                                 self->orig_connection,
+-- 
+GitLab
+
diff --git a/gnome-control-center.spec b/gnome-control-center.spec
index 4520336..7b6cfc7 100644
--- a/gnome-control-center.spec
+++ b/gnome-control-center.spec
@@ -25,6 +25,9 @@ Source0:        https://download.gnome.org/sources/%{name}/45/%{name}-%{tarball_
 
 Patch:          0001-keyboard-Use-new-gnome-desktop-api-for-getting-defau.patch
 
+# https://gitlab.gnome.org/GNOME/gnome-control-center/-/merge_requests/1935/
+Patch:          fix-vpn-config.patch
+
 BuildRequires:  desktop-file-utils
 BuildRequires:  docbook-style-xsl libxslt
 BuildRequires:  gcc