appending additional options to JAVA_TOOL_OPTIONS at runtime

[bkrajendra]

I understand there are multiple answers related to how to use env variables for java process in distroless image here.
But I specifically want to ask about how we can concate/append the additional options to JAVA_TOOL_OPTIONS in distroless image while runtime.

Presently I have following:
base image: app-base content:

ARG REGISTRY
FROM gcr.io/distroless/java21-debian12@sha256:4c79ab242b99bf7ce29f97be45c0c360e3ecd564475becdfcdcc01a3196777ac

# default JAVA_TOOL_OPTIONS
ENV JAVA_TOOL_OPTIONS "-Dorg.apache.catalina.session.StandardSession.ACTIVITY_CHECK=true  -Dcatalina.home=/apps/example/conf/vault -Dorg.apache.activemq.SERIALIZABLE_PACKAGES=* -Doracle.jdbc.J2EE13Compliant=true"

myservice Dockerfile content:

ARG REGISTRY
FROM ${REGISTRY}/example/app-base:9.1.5

WORKDIR /opt/myservice

# Copy binary from target directory
COPY ./myservice/target/base-service.jar /opt/myservice/app.jar

# Execute java binary.
ENTRYPOINT ["java", "-Dloader.path=/apps/lib/", "-jar", "app.jar"]

# Expose at port
EXPOSE 8080
EXPOSE 443

Now while running the myservice container in kubernetes, I want to provide additional option "-DSERVICE_NAME=ia"
using:

        env:
        - name: JAVA_TOOL_OPTIONS
          value: "-DSERVICE_NAME=ia"

This will overwrite the default JAVA_TOOL_OPTIONS options.
This does not work; I need to provide entire var string to make this work:

        env:
        - name: JAVA_TOOL_OPTIONS
          value: "-Dorg.apache.catalina.session.StandardSession.ACTIVITY_CHECK=true  -Dcatalina.home=/apps/example/conf/vault -Dorg.apache.activemq.SERIALIZABLE_PACKAGES=* -Doracle.jdbc.J2EE13Compliant=true -DSERVICE_NAME=ia"

How can I make sure that variables are appended in distroless considering expansion is not supported.