Marathon Bancorp, Inc. /MD/

Disclosure controls and procedures are the controls and other procedures that are designed to ensure that information required to be disclosed in the reports that the Company files or submits under the Securities and Exchange Act of 1934, as amended (the “Exchange Act”) is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed in the reports that the Company files or submits under the Exchange Act is accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can only provide reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must necessarily reflect the fact that there are resource constraints and that management is required to apply its judgement in evaluating the benefits of possible controls and procedures relative to their costs.

Under the supervision and with the participation of the Company’s management, including the Company’s Chief Executive Officer and Chief Financial Officer, the Company has evaluated the effectiveness of the Company’s disclosure controls and procedures as defined in Rules 13a-15 and 15d-15(e) under the Exchange Act as of June 30, 2026. Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that, as of June 30, 2026, the Company’s disclosure controls and procedures are effective to ensure that information required to be disclosed in the reports that the Company files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms.

Management’s Report on Internal Control over Financial Reporting

Management of Marathon Bancorp, Inc. is responsible for establishing and maintaining effective internal control over financial reporting.

Management evaluates the effectiveness of internal control over financial reporting and tests for reliability of recorded financial information through a program of ongoing internal audits. Any system of internal control, no matter how well designed, has inherent limitations, including the possibility that a control can be circumvented or overridden and misstatements due to error or fraud may occur and not be detected. Also, because of changes in conditions, internal control effectiveness may vary over time. Accordingly, even an effective system of internal control will provide only reasonable assurance with respect to financial statement preparation.

The Company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with accounting principles generally accepted in the United States of America. The Company’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with accounting principles generally accepted in the United States of America, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the financial statements.

Management assessed the Company’s internal control over financial reporting as of June 30, 2026, as required by Section 404 of the Sarbanes-Oxley Act of 2002, based on the criteria for effective internal control over financial reporting described in the “2013 Internal Control-Integrated Framework issued by the Committee of Sponsoring

Organizations of the Treadway Commission.” Based on this assessment, management concludes that, as of June 30, 2026, the Company’s internal control over financial reporting is effective.

There were no changes made in our internal controls during the quarter ended June 30, 2026 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

This Annual Report does not include an attestation report of the independent registered public accounting firm because the Company is classified as a non-accelerated filer.