diff --git a/prog/weaver/main.go b/prog/weaver/main.go
index ca2d5495..ba1e8e7f 100644
--- a/prog/weaver/main.go
+++ b/prog/weaver/main.go
@@ -128,23 +128,15 @@ func main() {
 	config.ProtocolMinVersion = byte(protocolMinVersion)
 
 	overlays := weave.NewOverlaySwitch()
-	if datapathName != "" {
-		// A datapath name implies that "Bridge" and "Overlay"
-		// packet handling use fast datapath, although other
-		// options can override that below.  Even if both
-		// things are overridden, we might need bridging on
-		// the datapath.
+	switch {
+	case datapathName != "" && ifaceName != "":
+		Log.Fatal("At most one of --datapath and --iface must be specified.")
+	case datapathName != "":
 		fastdp, err := weave.NewFastDatapath(datapathName, config.Port)
 		checkFatal(err)
 		networkConfig.Bridge = fastdp.Bridge()
 		overlays.Add("fastdp", fastdp.Overlay())
-	}
-	if ifaceName != "" {
-		// -iface can coexist with -datapath, because
-		// pcap-based packet capture is a bit more efficient
-		// than capture via ODP misses, even when using an
-		// ODP-based bridge.  So when using weave encyption,
-		// it's preferable to use -iface.
+	case ifaceName != "":
 		var err error
 		iface, err = weavenet.EnsureInterface(ifaceName)
 		checkFatal(err)
diff --git a/weave b/weave
index 8128bd44..f08cdaad 100755
--- a/weave
+++ b/weave
@@ -1622,7 +1622,6 @@ fetch_router_args() {
     CONTAINER_ARGS=$(docker inspect -f '{{.Args}}' $CONTAINER_NAME)
     IPRANGE=$(echo $CONTAINER_ARGS | grep -o -e '-ipalloc-range [^ ]*') || true
     NO_DNS_OPT=$(echo $CONTAINER_ARGS | grep -o -e '--no-dns') || true
-    WEAVE_PASSWORD=$(docker inspect -f '{{.Config.Env}}' $CONTAINER_NAME | sed -n -e 's/.*WEAVE_PASSWORD=\([^] ]*\).*/\1/p')
 }
 
 attach_router() {