With a bit of prep work, this can be achieved relatively simply

First, create a file, `addwlan.sh`, in the boot partition - contents at the end of the answer

in `cmdline.txt` on the boot sector you'll want to add (it's a single line by the way)

    systemd.run=/boot/firmware/addwlan.sh systemd.run_success_action=reboot systemd.unit=kernel-command-line.target

To the end of the line in `cmdline.txt`

It should end up looking like

    console=tty1 root=PARTUUID=****** rootfstype=ext4 fsck.repair=yes rootwait cfg80211.ieee80211_regdom=** systemd.run=/boot/firmware/addwlan.sh systemd.run_success_action=reboot systemd.unit=kernel-command-line.target

The \*\*\* will be something unique to your situation, DO NOT CHANGE

This is the contents of addwlan.sh in the boot partition:

Note:

* NAME: this will be the name of the `.nmconnection` file created and its `ID` \- note that `UUID` is generated
* SSID: the SSID you want to connect to
* PRIORITY: use negative for higher priority - FYI: default for wifi connections is zero
* HIDDEN: set to `true` if it is hidden
* PASS: leave blank for open AP
* PLAIN: set to 1 if you add the password in plain text, the code will convert it to a passphrase using `wpa_passphrase` otherwise use `PLAIN=0`

---

    #!/bin/bash
    
    # ---- configure connection - change as appropriate
    NAME=<connectionName>
    SSID=<SSID>
    PRIORITY=0
    HIDDEN=[true|false]
    PASS=<password>
    PLAIN=1
    # ---- end configure connection
    
    CONNFILE=/etc/NetworkManager/system-connections/${NAME}.nmconnection
    UUID=$(uuid -v4)
    
    if [ ! -z "${PASS}"]; then
        if [ $PLAIN -eq 1 ]; then
            PSK="$(wpa_passphrase ${SSID} ${PASS} | grep -T "psk" | grep -v '"' | cut -d= -f 2)"
        else
            PSK="${PASS}"
        fi
    fi
    
    cat <<- EOF >${CONNFILE}
    [connection]
    id=${NAME}
    uuid=${UUID}
    type=wifi
    autoconnect-priority=${PRIORITY}
    [wifi]
    mode=infrastructure
    ssid=${SSID}
    hidden=${HIDDEN}
    [ipv4]
    dns-priority=100
    method=auto
    [ipv6]
    dns-priority=50
    addr-gen-mode=default
    method=auto
    [proxy]
    EOF
    if [ ! -z "${PASS}" ]; then
        cat <<- EOF >>${CONNFILE}
    [wifi-security]
    key-mgmt=wpa-psk
    psk=${PSK}
    EOF
    fi
    chmod 600 ${CONNFILE}
    sed -i 's| systemd.run=/boot/firmware/addwlan.sh.*||g' /boot/firmware/cmdline.txt
    exit 0

Put the SD card back in the pi and reboot. Note, there will be a second reboot once the config is written, so be patient.

Tested to work on Pi 4 running latest Raspberry Pi Bookworm - should work if you installed 64bit bookworm or trixie - no guarantees if you went for 32 bit