Append Workload Identity using GCP Config connector

I am initially creating an IAMPolicy with some bindings

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicy
metadata:
  name: storage-admin-policy
  namespace: cnrm-system
  annotations:
    argocd.argoproj.io/sync-wave: "2"
    cnrm.cloud.google.com/project-id: "mysten-sui"
spec:
  resourceRef:
    apiVersion: iam.cnrm.cloud.google.com/v1beta1
    kind: IAMServiceAccount
    name: storage-admin
    namespace: cnrm-system
  bindings:
    - role: roles/iam.workloadIdentityUser
      members:
        - serviceAccount:mysten-sui.svc.id.goog[monitoring/thanos-compactor] 

But I would want to append some new entries of workloadIdentityUser, for which I was using

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: ax001-sa-policy
  namespace: ax001
spec:
  resourceRef:
    apiVersion: iam.cnrm.cloud.google.com/v1beta1
    kind: IAMServiceAccount
    name: storage-admin
    namespace: cnrm-system
  bindings:
    - role: roles/iam.workloadIdentityUser
      members:
        - member: serviceAccount:mysten-sui.svc.id.goog[ax001/ax001-prometheus]

But it seems like the entries are not being appended, instead, they are being overridden. Is there any way that I can append rather than overriding?