OK, it took a bit of work to improve the antenna. The included one was cut (you could see in previous image).
Fortunately I have a drawer of dead electronics waiting to go to the recycler. And one of them includes a Sonos ZP80. So, i ripped it open and extracted one of its 2.4GHz antenna.
Now, the overall setup looks a bit like an IED, I wouldn’t take it through an airport or anything. But, plugged it in, check with TCPDUMP and we can see an IPSEC tunnel (in NAT-T mode) has come up (to AllStream, a local-ish telco), so presumably it called home successfully.
For my security it got put on its own VLAN so it gets to the Internet, but not within the house.