cset failing (PVE7)

Trying to shield my pinned cpus (0-7) with the following command:

cset shield --cpu=0-7

But I just get this error:

mount: /cpusets: none already mounted on /sys/fs/bpf. cset: **> mount of cpuset filesystem failed, do you have permission?

The CPU pinning cmd does work fine (taskset --cpu-list --all-tasks --pid 0-7 "$(< /run/qemu-server/100.pid)")

Any suggestions? thanks.

PVE 7.0-11, nosub repo.