diff --git a/prog/weaver/main.go b/prog/weaver/main.go
index 798a1f5a..604d0eb6 100644
--- a/prog/weaver/main.go
+++ b/prog/weaver/main.go
@@ -268,6 +268,10 @@ func main() {
 	config.TrustedSubnets = parseTrustedSubnets(trustedSubnetStr)
 	config.PeerDiscovery = !noDiscovery
 
+	if isAWSVPC && len(config.Password) > 0 {
+		Log.Fatalf("--awsvpc mode is not compatible with the --password option")
+	}
+
 	db, err := db.NewBoltDB(dbPrefix + "data.db")
 	checkFatal(err)
 	defer db.Close()
diff --git a/weave b/weave
index 18b69d44..9bc0340f 100755
--- a/weave
+++ b/weave
@@ -1608,6 +1608,10 @@ launch_router() {
             exit 1
         fi
     else
+        if [ -n "$AWSVPC" -a -z "$IPRANGE" ] ; then
+            echo "ERROR: Empty --ipalloc-range is not compatible with --awsvpc." >&2
+            exit 1
+        fi
         if [ -n "$IPRANGE" ] && ! check_overlap $IPRANGE ; then
             echo "WARNING: Specified --ipalloc-range $IPRANGE overlaps with existing route on host." >&2
             echo "Unless this is deliberate, you must pick another range and set it on all hosts." >&2