Maintainer cannot create protected branch

Gitlab Omnibus v12.5.2-ee

One of our maintainers is trying to create a branch that is wildcard-protected. I (project owner) have a specific user (not this one) set for "Allowed to merge" and the same specific user, plus Maintainers, set "Allowed to push". I can create the branch just fine.

The user trying to create the branch has Developer permissions by LDAP Group Sync, and is set Maintainer manually in project Members, no expiration. I don't see any Gitlab permissions specifically for "Allowed to create protected branches", so I have to assume that what Gitlab is doing under the covers is (1) create branch, then (2) push branch, which suggests that this Maintainer user (based on the protection permissions described above), should be able to create this branch.