Custom action succeeds as FileKey but fails from WiXQuietExec

I am able to call an exe when using FileKey and ExeCommand in my tag but when I use WixQuietExec64 it fails with an error that is symptomatic of not calling the exe with elevated privileges

MSI (s) (DC:34) [14:40:06:767]: Executing op: ActionStart(Name=InstallDebian,,)
MSI (s) (DC:34) [14:40:06:830]: Executing op: CustomActionSchedule(Action=InstallDebian,ActionType=3073,Source=BinaryData,Target=WixQuietExec64,CustomActionData="C:\Program Files (x86)\TARFU\debian.exe" install --root)
MSI (s) (DC:78) [14:40:06:830]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIADB5.tmp, Entrypoint: WixQuietExec64
MSI (s) (DC:7C) [14:40:06:845]: Generating random cookie.
MSI (s) (DC:7C) [14:40:06:845]: Created Custom Action Server with PID 9088 (0x2380).
MSI (s) (DC:68) [14:40:06:877]: Running as a service.
MSI (s) (DC:68) [14:40:06:877]: Hello, I'm your 32bit Elevated Non-remapped custom action server.
WixQuietExec64:  Installing, this may take a few minutes...
WixQuietExec64:  
WslRegisterDistribution failed with error: 0x80070005
WixQuietExec64:  
Error: 0x80070005 Access is denied.
WixQuietExec64:  

WixQuietExec64:  
WixQuietExec64:  Error 0x80070001: Command line returned an error.
WixQuietExec64:  Error 0x80070001: QuietExec64 Failed
WixQuietExec64:  Error 0x80070001: Failed in ExecCommon method
CustomAction InstallDebian returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 14:40:06: InstallFinalize. Return value 3.

Excerpt of my product.wxs

<SetProperty Id="InstallDebian" Value="&quot;[#DebianExe]&quot; install --root"
            Before="InstallDebian" Sequence="execute"/>
<CustomAction Id="InstallDebian" BinaryKey="WixCA" DllEntry="WixQuietExec64"
            Execute="deferred" Return="check" Impersonate="no"/>

InstallDebian is called after InstallFiles. I also tried WixQuietExec, CAQuietExec64, CAQuietExec

How can I successfully run this exe quietly and with escalation?

impersonate="yes" fixed it for me, seems like debian.exe does not properly run when user is SYSTEM