Yes, for non-dynamic settings you will need to make the change to elasticsearch.yml and then perform a rolling restart.
This is a requirement in particular for this security-sensitive setting so that any potential attacker cannot just turn scripts on and then try to exploit Elasticsearch with scripting.