diff --git a/instantout/manager.go b/instantout/manager.go
index bebd8f82..e96791e3 100644
--- a/instantout/manager.go
+++ b/instantout/manager.go
@@ -156,6 +156,24 @@ func (m *Manager) NewInstantOut(ctx context.Context,
 		if err != nil {
 			return nil, err
 		}
+
+		if !sweepAddr.IsForNet(m.cfg.Network) {
+			return nil, fmt.Errorf("sweep address %s is not "+
+				"valid for network %s", sweepAddress,
+				m.cfg.Network.Name)
+		}
+
+		switch sweepAddr.(type) {
+		case *btcutil.AddressTaproot,
+			*btcutil.AddressWitnessScriptHash,
+			*btcutil.AddressWitnessPubKeyHash,
+			*btcutil.AddressScriptHash,
+			*btcutil.AddressPubKeyHash:
+
+		default:
+			return nil, fmt.Errorf("unsupported sweep address "+
+				"type %T", sweepAddr)
+		}
 	}
 
 	m.Lock()
diff --git a/looprpc/perms.go b/looprpc/perms.go
index 4a438914..eb793687 100644
--- a/looprpc/perms.go
+++ b/looprpc/perms.go
@@ -184,6 +184,9 @@ var RequiredPermissions = map[string][]bakery.Op{
 	"/looprpc.SwapClient/ReservationRequest": {{
 		Entity: "swap",
 		Action: "execute",
+	}, {
+		Entity: "loop",
+		Action: "out",
 	}},
 	"/looprpc.SwapClient/ReservationQuote": {{
 		Entity: "swap",